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PREFACE 


It  is  now  rather  more  generally  recognized  that  in  order  to  achieve  an  adequate  to 
high  Pfc,  Probability  of  Kill,  that  NATO  systems  have  to  pursue  a  higher  degree  of  integra¬ 
tion  than  in  the  past  while  yet  being  adequately  flexible  and  survivable.  This  was  the 
essential  theme  of  this  Symposium  which  addressed  the  various  relevant  issues  rather 
broadly  in  its  various  sessions,  as  suggested  by  the  program  listed  at  the  end.  Rather 
generally,  such  systems,  either  on  a  specific  platform  or  else  in  a  battlefield  scenario 
involve  the  proper  coupling  of  front  end  sensors  to  data  processing  systems  which  in  turn 
either  control  the  delivery  of  a  weapon  system  accordingly  or  else  display  the  requisite 
information  for  the  system  operator/ controller  who  in  turn  controls  the  delivery  of  the 
weapon  system.  The  guidance  and  control  implications  and  realizations  for  systems 
functioning  within  such  an  integrated  environment  then  follow  accordingly,  including 
the  specifications  on  requisite  mid-course  guidance  and  control  systems,  terminal  seeker 
capability  requirements,  and  other  fundamental  requirements. 
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TECHNICAL  EVALUATION  REPORT 


by 

Professor  C.T.Leondes,  Ph.  D. 
Engineering  Systems  Department 
School  of  Engineering  and  Applied  Sciences 
7620  Boelter  Hall 

University  of  California  -  Los  Angeles 
Los  Angeles,  California  90024 
USA 


INTRODUCTION 

The  fact  that  NATO  forces  must  react  to  WPF  (Warsaw  Pact  Forces)  of  vast  quantitative  superiority  in  all  areas 
through  the  continuing  development  of  qualitatively  superior  weapons  has  been  generally  acknowledged  for  sometime. 
This  was  essentially  the  theme  for  the  33rd  Guidance  ami  Control  Panel  Symposium,  namely,  an  examination  of  a 
number  of  significant  diverse  issues  in  developing  qualitatively  superior  NATO  weapons  systems.  This  enormously 
important  area  will  probably  continue  to  receive  treatment  at  various  times  in  the  future  in  subsequent  NATO  AGARD 
symposia. 

Before  examining  the  content  of  the  33rd  and  GCP  Symposium  it  is  perhaps  worthwhile  to  briefly  examine  several 
examples  of  Air  Force,  Army,  and  Navy  systems  that  achieve  a  most  highly  significant  qualitative  superiority  through  a 
high  degree  of  effective  systems  integration.  It  should  also  be  noted  that  at  all  times  any  approach  to  qualitative  superiority 
through  highly  integrated  systems  must  not  be  unduly  exposed  thereby  to  vulnerabilities  as  the  result  of  enemy  actions. 
The  program  content  of  the  33rd  GCP  Symposium  systems  was  similar  to  those  noted  in  the  examples  below. 

First,  exploring  an  Air  Force  example,  it  is  highly  desirable  to  blunt  any  WPF  attempt  to  support  a  possible  break¬ 
through  (first  echelon)  of  land  forces  through  reinforcement  (2nd  echelon)  by  denying  those  2nd  echelon  reinforcements. 
These  reinforcements  will,  of  course,  include  armor,  APCs  (armored  personnel  carriers),  SPHs  (Self-Propelled  Howitzers), 
and  other  systems  and  support  elements.  In  order  to  deny  these  reinforcements  they  must  first  be  detected  and  targeted, 
that  is,  their  composition  and  position  must  be  determined  to  sufficient  accuracy.  At  present  in  the  NATO  community 
this  is  being  pursued  through  several  means  including  airborne  radar  surveillance  platforms.  Once  the  2nd  echelon  forces 
have  been  targeted  then  standoff  weapons,  such  as  Assault  Breaker,  may  be  delivered  against  them.  These  stand  off 
weapons  typically  use  mid-course  guidance  as  well  as  terminally  guided  submunitions  in  order  to  achieve  a  high 
(Probability  of  Kill).  Of  course,  interdiction  aircraft  with  target  acquisition  and  laser  designating  pods  may  be  utilized  in 
addition  to  other  weapons  systems  possibilities. 

Now  considering  an  Army  system  example,  statistics  from  previous  Army  land  battles  have  demonstrated  that,  for 
example,  2000  artillery  projectile  rounds  are  required  before  an  armored  kill  is  achieved.  There  are  numerous  serious 
faults  with  this.  First,  the  highly  mobile  WPF  would  overrun  NATO  land  forces  before  2000  rounds  per  target  kill  could 
be  expended.  Secondly,  the  logistics  requirements  for  2000  rounds  per  kill  are  no  longer  tolerable  for  NATO  forces. 

Other  serious  disadvantages  may  be  readily  cited.  Obviously,  what  is  desired  is  a  highly  mobile  artillery  piece,  an  SPH 
(Self  Propelled  Howitzer),  which  can  achieve  a  very  high  Pg  per  projectile  round.  Such  can,  in  fact,  be  achieved.  The 
basic  principles  include  an  SrH  with  a  precision  (Self)  position  determination  system  such  as  GPS,  JTIDS,  or  PLRS 
(Position  Locating  and  Repo.' jng  System).  In  addition,  an  airborne  surveillance  system  such  as  SOTAS  (Standoff  Target 
Acquisition  System),  10  (Makrinos)*,  serves  the  essential  function  of  targeting  and  data  linking  targeting  information  to 
the  SPH.  In  turn,  the  SPH  then  fires  a  PGM  (Precision  Guided  Munition)  which,  as  a  result  of  its  self-contained  terminal 
seeker  and  guidance  and  control  capability,  can  achieve  a  very  high  Pk  .  In  other  words,  the  capability  of  a  target  kill 
per  round  is  well  within  the  realm  of  feasibility. 

Naval  systems  are  also,  of  course,  rich  with  possibilities  in  integrated  systems.  For  instance,  passive  or  active,  how 
sonar  arrays  functioning  in  concert  with  towed  arrays,  either  on  surface  ships  or  on  submarines,  can  effectively  target, 
that  is,  carry  out  the  so-cr.iled  localization  process,  for  the  delivery  of  stand-off  weapons  which  can  then  relocalize  when 
in  the  vicinity  of  the  target  in  order  to  achieve  a  high  Pk . 


•Numbeis  and  authorfs)  namets)  refer  to  papen  presented  at  the  33rd  GCP  Symposium.  See  Contents,  pages  v  and  vi. 


We  turn  now  to  an  examination  of  the  contents  of  the  33rd  GCP  Symposium.  After  noting  briefly  tha'  the  keynote 
address  covered  issues  such  as  those  noted  above,  among  other  issues. 


OPERATIONAL  REQUIREMENTS  SESSION 

The  introduction  demonstrated  by  three  significant  examples  for  Air  Force,  Navy,  and  Army  systems  how 
operational  requirements  can  be  met  in  a  much  more  effective  manner  through  systems  integration,  and  this  was 
elaborated  on  further  in  this  session.  The  paper  by  Chislett1  developed  this  by  pursuing  the  specific  but  very  broad  area 
of  air  defense  systems  issues  and  the  necessary  systems  in  the  specific  case  of  the  UKADGE,  UK  Air  Defense  Ground 
Environment.  Improvement  Program.  The  second  paper  by  Krogull  and  Mutter2  examined  the  broad  and  fundamental 
issues  of  command  and  control  systems  and  their  force  multiplier  implications.  How  can  operational  requirements  be 
determined  either  for  specific  platforms  or  systems  or  else  for  a  broad  collection  of  systems?  There  is,  of  course,  no 
single  specific  means  for  doing  so,  but  rather  a  combination  of  means.  In  particular,  analyses  of  operational  situations  can 
be  essentially  useful,  and,  indeed,  in  many  instances  is  the  only  available  avenue.  In  other  cases,  prior  experiences  with 
particular  platforms  can  be  essentially  useful.  Still  in  other  cases  field  exercises  such  as  Reforger,  Strong  Express.  Red 
Flag,  and  others  are  essentially  useful.  In  tmth,  the  combination  of  all  these,  that  is.  analyses,  prior  experiences  with 
specific  platforms,  large  scale  field  exercises,  and  other  such  means  are  essentially  valuable  in  defining  operational  require¬ 
ments  and,  it  might  be  added,  operational  doctrine,  for  instance,  as  well,  implied  in  all  of  the  above,  of  course,  is  an 
adequately  accurate  definition  of  the  threat,  not  only  as  it  is.  but  as  it  might  be.  The  fundamental  principle  here  is  the 
predictive  intelligence  and  preemptive  engineering  as  the  context  within  which  operational  requirements  are  to  be 
evolved. 


SESSION  ON  COOPERATIVE  INTERDEPENDENT  SYSTEM  CONSIDERATIONS 

The  papers  by  Stavropoulos3,  Brodies,  and  Milosevic6  emphasized  issues  with  respect  to  command  and  control 
systems.  The  paper  by  Stavropoulos  presented  a  comprehensive  rationale  for  the  definition  and  development  of 
command  and  control  systems.  The  paper  by  Brodie  on  JTIDS  and  Milosevic  on  SINTAC  III  described  specific  systems 
realizations  of  systems  for  the  ICNI,  Integrated  Communication,  Navigation,  and  IFF  function  so  essential  to  command 
and  control  systems.  It  is  worth  noting  that  such  systems  were  first  presented  over  10  years  ago  at  a  GCP  NATO  AGARD 
meeting,  suggesting  once  again  the  long  development  time  all  too  characteristic  of  many  importantly  essential  NATO 
systems.  The  paper  by  Brammer4  was  an  interesting  presentation  of  the  integration  of  such  systems  for  the  achievement 
of  an  essential  operational  capability,  namely,  penetration  survival  by  penetration  at  low  altitude,  that  is.  penetration  at 
an  altitude  low  enough  to  survive  enemy  air  defense  systems.  One  of  the  importantly  essential  messages  in  this  session 
was  that  in  the  future  integrated  systems  both  at  the  platform  level  and  for  systems  involving  a  large  conglomeration  of  a 
broad  array  of  platforms  cooperative/interdependent  system  considerations  will  be  indispensably  essential. 


SESSION  ON  THREAT  AND  TARGET  DETECTION  AND  IDENTIFICATION 

Considering  the  theme  of  this  symposium,  most  certainly  an  absolutely  essential  issue  is  threat  or  target  detection 
and  identification.  This  session  addressed  a  number  of  new  systems,  and  technologies  for  this  issue  were  addressed  in  this 
session.  Target  identification  is  one  of  the  most  challenging  issues  before  the  NATO  community,  and  is  being  pursued  by 
a  variety  of  means.  The  paper  by  Vattrodt,  et  al.,7  dealt  with  one  of  the  most  intriguing  new  approaches,  acoustic  means. 
It  is  difficult  to  tell  yet  where  this  technology  will  lead  to  in  so  far  as  operationally  viable  systems  are  concerned. 

However,  for  now,  at  least,  it  appears  to  definitely  merit  continuing  consideration.  The  paper  by  Rayner,  et  al.,8  explores 
the  issue  for  target  detection  for  air  ocean  surveillance  systems.  In  the  two  decades  after  World  War  II  these  systems  were 
in  a  high  learning  rate  phase.  The  last  decade  and  a  half  has  seen  some  rather  interesting  and  significant  realizations  of 
some  of  these  systems,  and  the  paper  by  Rayner  dealt  with  a  specific  recent  realization  of  advances  in  this  area. 

In  yet  another  area,  one  of  the  most  potentially  significant  recent  technology  developments  has  been  in  the  develop¬ 
ment  and  testing  of  mm  (millimeter)  wave  systems,  both  passive  and  active.  This  technology  is  being  explored  for  Army, 
Air  Force,  and  Navy  systems.  The  paper  by  Heiden9,  in  particular,  dealt  with  one  of  the  most  interesting  current  develop¬ 
ment  areas,  namely.  9*  GHY  active  mm  systems  for  highly  effective  tank  fire  control  systems. 

Every  Reforger  field  exercise  from  1 976  on  has  involved  the  utilization  of  SOTAS,  (Standoff  Target  Acquisition 
System),  one  of  the  single  most  significant  recent  developments  for  battlefield  surveillance  over  a  very  large  area.  The 
paper  by  Makrinos  and  Keneally 10  eminently  demonstrated  the  potentially  enormous  significance  of  this  system  in  a  wide 
variety  of  field  army  applications. 


SESSION  ON  AUTONOMOUS  INTEGRATED  WEAPONS  SYSTEMS 

It  is  well  recognized  that  while  many  advantages  accrue  to  integrated  systems,  the  individual  elements  or  platforms 
must  have  an  adequate  degree  of  autonomy  in  order  to  continue  to  be  effective  in  the  face  of  enemy  threats  which  would 
attempt  to  disrupt  or  destroy  the  integrated  functioning  of  NATO  systems.  The  first  two  papers  in  this  session  by  Lerche 
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and  Wither11  and  by  Camberlein.  et  al.,12  both  dealt  with  the  extremely  important  issue  of  individual  aircraft 
autonomously  penetrating  at  a  survivable  low  altitude  through  TF/TA  (Terrain  Following  Terrain  Avoidance)  techniques 
and  through  terrain  correlation  techniques.  The  issues  here  now  seem  to  be  well  in  hand  and  are  deployed  in  existing 
systems  Further  significant  advances  may  be  expected  to  be  continuously  made.  The  next  two  papers  by  Fraedrich13 
and  Arrowsmith14  dealt  with  advances  in  Tornado  integrated  guidance  and  control  systems  providing  a  higher  degree  of 
effective  autonomous  mission  capability.  In  both  impressive  systems  accuracy  performance  improvements  were 
demonstrated  for  these  integrated  systems.  The  paper  by  Leyland15  continued  the  treatment  of  autonomous  Tornado 
operations,  applicable,  of  course,  to  other  classes  of  aircraft  as  well,  this  time  for  the  ADV,  Air  Defence  Variant.  The 
remarkable  potential  of  the  ADV  both  within  the  command  and  control  environment  and  in  the  autonomous  mode  was 
developed  and  elaborated  upon  in  this  paper. 

Another  significant  trend  in  improving  the  autonomous  capability  of  aircraft  was  developed  in  the  paper  by  Landy , 
et  al.,16.  Very  significant  improvements  in  air  to  air  gunnery  and  air  to  ground  weapon  delivery  performance  through  the 
utilization  of  1FFC,  Integrated  Fire  Flight  Control,  concepts  were  presented  in  this  paper.  It  is  gratifying  to  see  such 
significant  techniques  currently  under  active  development.  The  paper  by  Shapiro11  developed  some  significant 
operational  scenarios  which  clearly  demonstrated  the  highly  significant  potential  for  autonomous  systems  for  rotary  wing 
aircraft  (helicopters)  and  described  some  detailed  systems  realizations.  Although  the  paper  by  Bryant18  was  not 
presented  the  next  GCP  Symposium  will  be  devoted  to  PGMs,  Precision  Guided  Munitions,  and  so  much  will  be  presented 
in  this  area  during  the  next  Symposium. 

Penetrating  aircraft  will  be  subject  to  an  intense  air  defense  environment.  As  these  systems  will  have  to  carry  a  signi¬ 
ficant  weapons  payload  capability  anything  in  the  way  of  a  SPW,  Self  Protect  Weapon,  capability  will  have  to  represent 
a  modest  payload  demand  and  yet  be  most  highly  effective.  The  paper  by  Johnson18  presented  a  comprehensive  analysis 
of  the  SPW  design  effectiveness  tradeoffs,  and  presented  some  intriguing  design  points  with  apparently  great  potential  in 
the  SPW  role. 


SESSION  ON  AFFORDABILITY  AND  SURVIVABILITY  CONSIDERATIONS 

Callaghan’s  paper20  led  this  session  off  with  a  comprehensive  excellent  articulation  of  the  disciplined  approach  that 
will  have  to  be  followed.  This  was  then  followed  by  an  excellent  paper  by  Logus21  that  elaborated  on  a  cycling  approach 
to  system  testing  that  offers  the  potential  of  significantly  greater  reliability  improvement.  Nesline's  paper22  explored 
hardware  and  software  trade-offs  for  one  of  the  important  new  NATO  air  to  air  missile  systems,  the  AMRAAM.  This 
session  closed  with  an  excellent  paper  by  Jones  and  Karmarkar23  on  a  new  modular  software  discipline  for  integrated 
systems  which  can  accommodate  growing  requirements  on  integrated  systems  and  verify  the  integrity  of  the  system, 
indeed,  most  significantly,  providing  very  impressive  fault  tolerance. 


CONCLUSION 

Integrated  systems  both  for  individuals  platforms  and  for  platforms  which  are  within  an  overall  system  are  now  an 
established  and  growing  phenomenon  in  the  NATO  community.  This  is.  of  course,  an  essential  necessity  in  the  face  of  the 
growing  threat  environment,  both  in  numbers  and  capabilities.  At  the  same  time  such  integrated  systems  must  have  an 
adequate  degree  of  autonomy  because  of  the  possibility  of  erosion  of  degrees  of  integration  as  a  result  of  enemy  action. 
Such  integration  must  be  achieved  in  an  affordable  and  reliable  manner.  All  these  issues  and  many  more  were  treated  in 
this  symposium.  However,  it  is  clear  that,  because  of  the  continual  growth  and  continuing  developments  in  this  very 
broad  area  throughout  the  NATO  community  that  the  subject  area  of  this  symposium  will  have  to  be  scheduled  again  at 
appropriate  times  in  the  future. 
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USE  OF  JOINT  TACTICAL  INFORMATION  DISTRIBUTION  SYSTEM 
(JTIDS)  FOR  AUTONOMOUS  AND  COOPERATIVE  WEAPON  GUIDANCE 


P.  M.  Brodie 

The  Singer  Company-Kear fott  Division 
1150  McBride  Avenue 
Little  Falls,  New  Jersey 


SUMMARY 

One  especially  useful  application  of  force  coordination  is  the  use 
of  a  Joint  Tactical  Information  Distribution  System  (JTIDS)  tactical 
grid  for  both  the  autonomous  and  cooperative  control  of  guided 
weapons.  Although  there  are  presently  no  plans  or  intentions  to  do 
so,  JTIDS  enables  a  weapon  with  moderate  accuracy  low  cost  inertial 
reference  equipment  to  regularly  update  its  grid  location  in  a  com¬ 
pletely  passive  manner.  A  full  exchange  of  tactical  data  (i.e., 
fire  control  information)  can  be  made  to  the  weapon  over  the  JTIDS 
grid.  Significantly  greater  guidance  accuracy  is  also  achieved  due 
to  the  precise  Time  of  Arrival  (TOA)  information  available  on  the 
JTIDS  grid. 


1.  INTRODUCTION 

Successful  tactical  strategies  against  adversaries  wittf  greater  resources  of  manpower 
and  equipment  require  the  complete  coordination  of  available  resources.  A  highly  coor¬ 
dinated  and  flexible  force  can  have  its  effectiveness  greatly  amplified  as  its  assets  can 
be  brought  together  in  the  most  effective  manner.  JTIDS  is  one  way  to  achieve  this  uni¬ 
fied  command  and  control  structure. 

JTIDS  is  a  jam  resistant,  secure  CNI  system  presently  in  its  Full  Scale  Development  pro¬ 
gram  phase.  As  a  local  tactical  grid  system,  JTIDS  possesses  the  ability  to  distribute 
fire  control  and  weapon  guidance  data  as  well  as  precise  TOA  ranging  information. 
Present  (and  planned)  radio  guidance  systems  require  the  establishment  of  special  weapon 
support  stations  for  both  ground  and  airborne  use.  By  contrast,  a  JTIDS  based  weapon 
system  would  operate  with  standard  unmodified  JTIDS  tactical  terminals  which  usually 
will  have  been  deployed  in  the  tactical  area  for  other  purposes. 

2.  BENEFITS  OF  JTIDS  BASED  WEAPON  GUIDANCE 

Several  distinct  guidance  benefits  accrue  with  the  use  of  JTIDS.  Although  many  of  these 
benefits  can  be  achieved  with  existing  systems,  none  except  JTIDS  has  the  ability  to 
supply  them  all  with  such  little  systejn  impact.  Some  of  the  more  important  of  these 
features  necessary  for  cooperative  or  Cz  guidance  are  listed  below: 

•  Direct  and  Over-The-Horizon  Communication  with  the  weapon  via  a  JTIDS  net. 

•  Direct  and  Over-The-Horizon  Guidance  with  JTIDS. 

•  Real  Time  knowledge  of  the  location  of  targets  and  missiles  in  flight. 

•  Ability  to  retarget  in  flight,  as  each  is  located  in  a  JTIDS  Relative  Navi¬ 

gation  Grid. 

•  Improved  Seeker  Probability  of  Acquisition. 

•  Reduced  Probability  of  Enemy  Detection 

Despite  the  fact  that  reception  of  JTIDS  signals  are  on  a  line  of  sight  basis,  use  of  a 
JTIDS  grid  with  typically  dispersed  members  permits  communication  and  control  to  be 
exercised  between  members  that  are  not  within  direct  sight  of  each  other.  This  can  be 
accomplished  by  means  of  the  normally  available  JTIDS  relay  function.  Thus  fire  control, 
targeting,  force  location,  weapon  status  and  distribution  information  can  be  made  avail¬ 
able  to  the  command  and  control  member  of  the  grid  on  a  near  real  time  basis.  In  a 
similar  manner,  guidance  information  can  be  uplinked  to  a  missile  either  in  a  direct  or 
over  the  horizon  application.  JTIDS  then  supplies  the  information  necessary  for  either 
cooperative  or  autonomous  missile  guidance. 

In  the  cooperative  case,  two-way  communication  is  maintained  between  JTIDS  grid  partici¬ 
pants.  In  a  JTIDS  TDMA  (Time  Division  Multiple  Access)  grid,  communication  is  often 
represented  by  a  communication  "ring"  or  net,  as  shown  in  Figure  1.  Each  user  has  pre¬ 
assigned  slots  in  which  he  can  transmit  information  in  a  broadcast  fashion.  A  TOA 
measurement  is  usually  made  upon  the  receipt  of  transmitted  data.  As  each  net  member 
regularly  transmits  his  grid  location  as  well,  it  is  possible  for  the  weapon  to  compute 
its  own  grid  location  by  the  reception  of  data  from  two  or  more  grid  participants. 
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For  autonomous  guidance  using  JTIDS,  the  weapon  terminal  need  only  receive;  i.e.r  remain 
completely  passive  or  radio  silent  in  flight.  Once  synchronized  into  the  JTIDS  net,  the 
missile  terminal  can  listen  to  the  normal  transmissions  of  active  net  members  to  regu¬ 
larly  locate  itself  in  a  n-.vigational  grid.  While  remaining  passive,  fire  control  infor¬ 
mation  supplying  data  on  target  location  or  changes,  arming  and  recall  commands  can  be 
easily  transmitted  in  multiple  weapon  scenarios.  A  form  of  JTIDS  Relative  Navigation  is 
the  most  appropriate  way  of  implementing  control  for  both  autonomous  and  cooperative 
cases.  The  only  difference  is  that  in  the  fully  passive  case  position  is  correlated  into 
system  clock  time.  In  practice.  Relative  Navigation  is  achieved  by  the  optimal  combina¬ 
tion  or  statistical  filtering  of  both  radio  ranging  and  inertial  sensor  data.  In  this 
manner,  performance  is  achieved  which  is  superior  to  that  obtainable  in  either  system 
alone  (i.e.,  a  radio  navigation  system  or  an  inertial  navigation  system).  The  ranging 
portion  of  JTIDS  is  certainly  more  accurate  than  the  positional  accuracy  of  an  inertial 
system.  However,  the  inertial  system  supplies  continuous  navigation  thereby  permitting 
a  navigation  grid  to  be  developed  based  on  sequential  range  measurements  from  several  net 
members  non-synchronously .  With  this  technique,  navigation  can  in  fact  be  achieved 
between  as  few  as  two  net  members.  However,  the  most  important  feature  of  Relative  Navi¬ 
gation  is  that  it  creates  a  network  of  users  locked  into  a  precise  grid  system.  Each 
grid  member  acts  as  a  distributed  sensor  in  this  network  system  which  can  be  easily 
structured  (via  the  TDMA  link)  to  perform  weapon  guidance.  DME  target  data  are  brought 
into  this  precise  positioned  grid,  and  coordinated  weapon  delivery  can  be  routinely  per¬ 
formed  as  positional  data  are  exchanged  between  all  participants  in  this  common  tactical 
grid.  Thus,  data  sensed  by  one  grid  member  (either  external  data  such  as  targeting  or 
inertial  data  such  as  member  position)  can  be  effectively  utilized  by  another  grid  member 
as  if  sensed  directly.  This  form  of  data  augmentation  is  one  of  the  most  useful  features 
of  JTIDS  Relative  Navigation. 


3.  TERMINALLY  AUGMENTED  GUIDANCE 

Although  JTIDS  navigation  exhibits  accuracies  consistent  with  most  high  performance 
radio  ranging  systems,  there  are  many  weapon  applications  where  greater  performance  is 
desired.  To  achieve  such  performance  levels,  terminal  seeking  systems  (radio,  radar, 
optical,  etc.)  are  usually  employed.  There  are  additional  reasons  for  using  terminal 
guidance  systems  as  well  in  conjunction  with  JTIDS.  For  example: 

•  To  attack  moving  targets  - 

Normally  supplied  fire  control  targeting  updates  may  become  stale  very 
quickly.  Even  rapidly  updated  cooperative  targeting  via  JTIDS  is  usually  less 
desirable  than  autonomous  target  sensing. 

•  Targets  with  EW  jamming  capability  - 

By  design,  JTIDS  terminals  exhibit  a  strong  jam-resistant  capability.  How¬ 
ever,  as  a  jammer  is  approached,  there  will  be  some  range  at  which  communica¬ 
tion  with  the  weapon  is  no  longer  possible.  Autonomous  terminal  sensing  is 
usually  essential  in  these  applications.  The  objective  of  JTIDS  guidance  is 
then  to  provide  sufficient  flight  accuracy  and  positional  knowledge  to  permit 
terminal  sensor  acquisition  of  the  target. 


In  these  terminal  flight  segments,  JTIDS  performance  is  no  longer  a  factor  with  ultimate 
guidance  accuracy  then  dependent  upon  terminal  seeker  accuracy  and  vehicle  aerodynamic 
maneuverability  constraints. 


54 


GDOP  SINGULARITIES  AND  POSITIONAL  PERFORMANCE 
FIGURE  3 


Figure  4  indicates  the  second  or  more  common  form  of  GDOP.  Here  weapon  guidance  is 
obtained  in  reference  to  alternate  pairs  of  JTIDS  stations  indicated  by  the  numerals  1 
to  3.  Resulting  cross-range  guidance  performance  for  an  aerodynamically  controlled 
vehicle  is  shown  on  the  right.  The  topmost  curve  represents  actual  vehicle  performance 
while  the  lower  curves  represent  where  the  JTIDS  terminal  believes  the  vehicle  to  be. 
Numbers  1,  2  and  3  correspond  to  the  location  of  JTIDS  support  terminals  shown  on  the 
left.  Stations  located  at  3  represent  good  grid  geometry  which  results  in  a  cross  range 
position  error  (as  shown  on  the  second  curve  from  the  top)  which  is  essentially  equal  to 
the  JTIDS  2  ranging  error.  Lower  curves  2  and  1,  represent  progressively  poorer  per¬ 
formance,  corresponding  directly  to  the  poor  station  locations  shown  on  the  left. 
Actually,  these  position  sensitivities  are  not  as  bad  as  they  may  first  appear  due  to  the 
fact  that  most  weapon  trajectories  are  not  over  extremely  short  ranges.  Thus  the  station 
location  requirement  is  an  important  but  not  especially  sensitive  requirement  for  most 
applications. 


HORIZONTAL  NET  OEONETRT  CONTROLLED  VEHICLE  PERFORMANCE 

CROSS  RANGE  POSITION 


GEOMETRIC  DEPENDENCE  OF  PERFORMANCE 
FIGURE  4 


5.  CONCLUSIONS 

A  standard  JTIDS  tactical  net  normally  supplying  secure  communication  and  navigation 
functions  can  also  be  configured  to  support  hybrid  missile  guidance.  Due  to  the  inherent 
relay  feature  of  JTIDS,  weapons  can  be  commanded  and  guidance  implemented  even  in  over- 
the-horizon  target  cases. 

With  sufficient  care  in  designing  a  missile  guidance  subnet,  performance  can  be  obtained 
consistent  with  normal  JTIDS  airborne  operations.  A  particularly  promising  use  of  JTIDS 
guidance  is  in  the  midcourse  flight  phase,  where  it  aids  the  establishment  of  required 
terminal  flight  conditions. 
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Nearly  all  terminal  guidance  systems  need  an  inertial  reference  system  to  supply  a 
measure  of  vehicle  attitude.  If  the  terminal  flight  phase  is  short  enough,  reverting  to 
a  pure  inertial  mode  can  often  incur  negligible  guidance  penalty.  Additionally, 
inertial  accuracy  need  only  be  moderate  as  terminal  flight  times  are  usually  in  minutes 
and  can  be  supplied  by  either  a  strapdown  or  gimballed  inertial  reference.  Acceler¬ 
ometers  will  of  course  be  required  with  such  a  system.  The  two  largest  inertial  errors 
to  be  considered  are  Gyro  Drift  and  Platform  Misalignment.  Errors  due  to  accelerometer 
bias  will  appear  as  a  platform  misalignment  (after  alignment)  and  are  treated  as  such. 
Although  the  weapon's  inertial  reference  system  is  to  be  leveled  before  flight,  hybrid 
inflight  alignment  will  be  performed  with  JTIDS  Relative  Navigation.  A  JTIDS  based 
alignment  can  be  expected  to  update  position  and  day  to  day  gyro  drift,  but  will  not 
offer  much  improvement  for  accelerometer  calibration.  This  is  because  the  basic  meas¬ 
urement  supplied  by  JTIDS  is  position;  i.e.,  velocity  is  a  derived  variable.  In  practice 
this  accelerometer  bias  error  will  essentially  not  exist  (due  to  pre-launch  leveling). 

Figure  2  indicates  the  general  qualitative  effect  of  shifting  from  a  JTIDS  inertial 
mechanization  to  a  pure  inertial  terminal  mechanization.  Considering  constant  station 
geometry,  JTIDS  performance  remains  fairly  flat  until  terminal  phase  where  it  grows 
steeply  with  flight  time. 


GUIDANCE 

ACCURACY 


TIME  OF  FLIGHT 


JTIOS  SUPPORTED  MIDCOURSE  GUIDANCE 
FIGURE  7 


Naturally,  in  a  missile  with  terminal  seeking  capability,  impact  errors  are  dependent 
upon  the  performance  of  this  device.  Effectively,  inertial  errors  do  not  accrue  in 
flight  but  are  "reset"  by  the  terminal  seeker  in  a  hybrid  filtered  implementation. 


GEOMETRIC  DILUTION  OF  POSITION 


Aside  from  normally  encountered  ranging  errors,  GDOP  is  one  of  the  most  important  factors 
in  achieving  adequate  guidance  accuracy.  These  positional  errors  (and  resulting  guid¬ 
ance  errors)  occur  due  to  unfavorable  location  of  JTIDS  grid  participants.  GDOP  errors 
are  not  unique  to  JTIDS,  but  routinely  occur  in  most  ranging  systems  utilized  for  naviga¬ 
tion  and  guidance.  Although  related,  two  distinct  types  of  GDOP  errors  are  normally 
encountered  in  guidance  applications.  The  first  represents  a  true  mathematical  singu¬ 
larity,  while  the  second  is  due  to  less  optimal  JTIDS  grid  member  location.  Reference  to 
Figure  3  pictorially  indicates  the  guidance  singularity  case.  This  condition  is  often 
encountered  in  cases  where  a  weapon  is  launched  external  to  the  JTIDS  grid.  Ideally,  a 
weapon  should  be  initialized  and  launched  within  the  JTIDS  grid.  It  is  feasible  however, 
to  launch  external  to  the  grid  and  initialize  upon  entering.  This  is  the  case  repre¬ 
sented  in  Figure  3  where  the  weapon  is  shown  flying  from  left  to  right.  Typically,  JTIDS 
stations  will  be  located  along  the  flight  path  as  depicted  by  reference  number  1  in 
Figure  3.  Superimposed  upon  the  flight  path  are  heavy  lines  representing  the  standard 
deviation  of  the  navigation  performance  (i.e.,  ranging  plus  geometry  errors).  Note  that 
as  the  vehicle  approaches  a  point  adjacent  to  the  JTIDS  station,  navigational  errors 
increase  assymptotically .  This  is  to  be  expected  as  the  JTIDS  participants  form  a 
ranging  set  with  the  weapon.  As  the  weapon  approaches  these  terminals,  virtually  no 
along  track  data  can  be  obtained.  Fortunately  this  is  usually  a  relatively  short  portion 
of  flight  and  weapon  guidance  can  be  obtained  through  an  appropriate  guidance  filter 
design  as  indicated  by  the  dashed  lines. 


6-1 


SINTAC-3 

par 

Lj.  MILOSEVIC 

Directeur  A  la  Division  SystAmes  Electroniques 
THOMSON -CSE 

116,  avenue  Aristide  Briand 

92220  BAGNEUX 

FRANCE 

1  -  AMELIORATIONS  RECHERCHEES  PAR  RAPPQ.BT._AU  JTIDS7S-IMTACr2 

AprAs  une  analyse  dAtaillAe  des  performances  du  JTIDS/SINTAC-2  et  des  besoins  opArationnels  exprimAs 
pour  le  NIS,  nous  sommes  venus  &  la  conclusion  que  les  ameliorations  suivantes  doivent  Atre  apportAes  aux 
terminaux  JTIDS/SINTAC-2. 

-  C6td  MIPS 

.  simplifier  les  circuits  d1 acquisition, 

.  augmenter  la  capacity  d'un  terminal, 

.  augmenter  la  souplesse  d'utilisation  du  terminal  avec  des  formes  de  messages  diffArentes  : 
compactes  ou  distribuAes, 

.  maintenir  la  protection  contre  le  brouillage  pour  les  terminaux  simplifies, 

.  permettre  la  simplification  des  terminaux  pour  les  petits  porteurs. 

-  cate  NIS 

.  utilisation  du  canal  asynchrone  pour  1 ' identification  par  Q  et  R, 

.  avoir  une  disponibilite  proche  de  100  %  pour  ^identification  par  0  et  R, 

.  pouvoir  simplifier  le  terminal  multifonction  &  la  seule  fonction  d' identification  par  Q  et  R, 
si  nAcessaire,  sans  le  pAnaliser,  tout  en  gardant  1’interopArabilitA  avec  tous  les  terminaux 
multifonction. 

Ces  caractdristiques  s'ajoutent  a  celles  dAjA  obtenues  dans  le  5INTAC-1  et  le  S1NTAC-2  -de  facilite 
d' installation  dans  les  porteurs-  en  ne  rendant  pas  obligatoire  l'utilisation  de  l'antenne  directive  A 
1' interrogation,  grace  A  la  Designation  Interne. 

Mais  ceci  n'exclut  pas  l'utilisation  de  l'antenne  directive,  soit  pour  la  designation,  soit  seulement 
pour  1 ' augmentation  de  la  protection  contre  le  brouillage  si  1'une  ou  1 'autre  sont  jugAs  nAcessaires. 

C'est  une  possibilite  de  plus  qu'offre  le  systAme  qui  : 

-  permet  1' identification  par  les  porteurs  sur  lesquels  il  est  difficile,  sinon  impossible, 
d' installer  l'antenne  directive  de  performances  valables, 

-  amdliore,  dana  la  majoritd  des  cas,  les  performances  de  discrimination, 

-  augmente  la  fiabilitA  et  la  sAcuritA  du  systAme,  et, 

-  simplifie  les  terminaux. 

CONCEPT  NOUVEAU  DU  SYSTEME  :  SINTAC-3 


-  modification  du  procAdA  d'acquisition  basA  sur  la  dispersion  A  trAs  large  bande  du  spectre  de  modula¬ 
tion  conformAment  A  la  technique  proposAe  dans  le  NIS, 

-  maintien  sans  changement  du  procAdA  de  modulation  du  texte  utilisA  dans  le  JTIDS/SINTAC-2, 

-  interopArabilitA  avec  le  JTIDS/SINTAC-2. 

COMPLEXITE  DES  TERMINAUX  (figure  1) 

Cette  figure  montre  la  complexitA  relative  entre  le  terminal  JTIDS/SINTAC-2  classe  II  et  le  terminal 
SINTAC-3  de  capacitA  et  de  protection  contre  le  brouillage  similaires. 

TERMINAL  JT 1DS/SINTAC-2  CLASSE  II  AVEC  1  CHAINE  DE  RECEPTION 

Utilise  8  rAcepteurs  pour  1' acquisition  -8  rAcepteurs  sont  nAcessaires  pour  une  protection  suffisante 
du  prAambule  contre  le  brouillage-  mais  il  est  limitA  A  la  rAception  d'un  seul  texte  A  la  fois. 

IE5MINALJINIACO.DE.CAPACITEJQUIVALENTE 

Utilise  une  chaine  de  rAception  constituAe  de  deux  parties  : 

-  une  pour  1 'acquisition  du  prAambule, 

-  une  pour  la  rAception  du  texte, 

avec  la  mAme  protection  contre  le  brouillage  due  A  l'utilisation  d'une  largeur  de  bande  de  80  MHz 
pour  le  prAambule  d'acquisition. 
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PROTECTION  CONTRE  LE  BROUILLAGE  DU  CANAL  ASYNCHRONE  (figure  2) 


La  figure  montre  le  diagramme  de  protection  contre  le  brouillage  du  canal  asynchrone  et  son  ameliora¬ 
tion  par  le  SINTAC-3  par  rapport  d  celle  obtenue  par  le  JTIDS/SINTAC-2. 

F iqure  du  haut  :  Modulation  h  etalement  du  spectre  h  trfes  large  bande  et  la  distance  de  brouillage 
pour  tous  les  types  de  brouilleurs  y  compris  le  brouilleur  intelligent. 

Figure  du  bas  :  Modulation  &  etalement  du  spectre  faible  et  la  distance  de  brouillage  pour  un 
brouilleur  intelligent 

Energie  totale  ae  brouillage  identique  dans  les  deux  cas* 

C0MPLEX1TE  OES  EQU1PEMENTS  ET  D1FF1CULTES  D1 INSTALLA1 ION  CORRESPOND ANTES  (figures  3a  et  3b) 

La  figure  3a  represente  les  configurations  opdrationnelles  dans  lesquelles  peut  6tre  utilise  un  avion. 

Sur  la  figure  3b  du  haut,  sont  reprdsentds  les  dquipements  ndcessaires  pour  rdpondre  aux  demandes  du 
MIPS  et  du  NIS  dans  un  avion  : 

-  dquipements  du  JTIDS/SINTAC-2, 

avec  deux  antennes  :  haute  et  basse, 

-  dans  la  bande  basse  1,  le  rdcepteur , 

-  dans  la  bande  basse  2,  l'emetteur  r^cepteur , 

avec  deux  antennes,  basse  et  haute,  communes. 

-  dans  la  bande  haute  : 

.  le  rdcepteur  avec  3  antennes  hautes  et  3  antennes  basses,  pour  avoir  un  bon  diagramne  de 
rayonnement , 

.  l'emetteur  avec  antenne  directive  placde  dans  le  nez  de  1* avion. 

Sur  la  figure  du  bas,  est  represente  le  SINTAC-3,  qui  a  les  caracteristiques  exigges  par  le  MIDS  et  le 
NIS  et  qui  utilise  les  informations  fournies  par  le  systbme  de  navigation  autonome,  install^  de  toute  fagon 
dans  l'avion,  mais  non  exploits  par  les  systfemes  particulars  (ddcrits  ci-dessus). 

Dans  ce  systbme,  la  configuration  des  dquipements,  materiel  et  logiciel,  est  telle  que  le  terminal 
puisse  satisfaire  &  la  fiabilite  demandee. 

P0UU01R  DE  SEPARATION  (figure  4) 

La  figure  montre  les  avantages  de  la  designation  interne  sur  la  designation  externe  pour  l'identifica- 
tion  par  Q  et  R. 

-  DISTANCE  :  150  KM 

-  9^§i5^II9^.5!iI5?5i5-?*?_5NTENN§_OIRECTiyE  : 

-  ouverture  du  lobe  de  4” 
realise  s 

.  separation  laterale  :  10  km 

.  Separation  en  distance:  30  m 

-  DESIGNATION  INTERNE  UTIHSANT  LE  SYSTEME  PE  NAVIGATION  AUTONOME 

-  avec  une  precision  moyenne  de  1  km 
realise  : 

.  separation  laterale  :  1  km 

.  separation  en  distance:  30  m 

La  designation  interne  realise  un  pouvoir  de  separation  plus  grand  et  offre  des  avantages  evidents 
d' installation  et  de  coOt  des  equipements. 

2  -  CONCEPT  PU  SINTAC-3 

FORME  DU  MESSAGE  (figures  5  et  6) 

Le  message  est  constitue  de  deux  parties  : 

-  le  preambule,  et 

-  le  texte. 

Le  preambule  sert  &  trois  fonctions  : 

-  acquisition  du  message, 

-  differenciation  des  sous-canaux, 

-  predesignation  du  ou  des  correspondents  par  zone  ou  individuellement. 

Dans  ce  but  il  est  divise  en  deux  parties  : 

-  le  preambule  A,  constitue  de  la  trame  d'acquisition 

-  le  preambule  B,  constitue  de  deux  mots  : 

.  "MODE"  definissant  le  sous-canal, 

.  "PREDESIGNATION"  indiquant  la  zone  interessee  ou  fourniasant  le  code  individuel  du 
correspondent. 


La  bande  large  etant  reduite  de  100  MHz  4  80  MHz,  il  y  a  une  reduction  de  protection  de  1  dB  environ. 
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Le  texte  fournit  : 

-  la  synchronisation  fine, 

-  lbve  les  ambiguitea  que  la  preddsignation  a  pu  laisser, 

-  1 ' information  portbe  par  le  message. 

-  les  impulsions  du  prdambule  sont  modulbes  h  trbs  large  bande, 

-  les  impulsions  du  texte  sont  modulbes  6  bande  relativement  etroite,  bgale  b  celle  du  JTIDS  ou  SINTAC-2. 

-  les  impulsions  du  prbambule  et  du  texte  sont  transmises  par  "page"  (fig.  6)  avec  : 

-  un  taux  de  remplissage  faible, 

-  la  position  des  impulsions  dans  la  "page"  est  pseudo  albatoire  dbfinie  par  le  canal. 

Les  taux  de  remplissage  du  prbambule  et  du  texte  sont  definis  pour  : 

-  permettre  Emission  et  reception  simultanbes  entrelacbes  sans  perte  sensible,  ce  qui  entraine 
aussi  la  possibility  de  receptions  des  messages  entrelacbs  dans  le  mbme  canal, 

-  avoir  des  messages  suffisamment  courts  pour  rbpondre  aux  besoins  d' identification  par  Q  et  R. 

Cette  forme  de  message  : 

-  augmente  la  disponibilitb  des  terminaux, 

-  simplifie  sensiblement  1' organisation  des  canaux, 

-  ambliore  la  compatibility  entre  les  systbmes  independents  utilisant,  sur  le  mbme  porteur, 
la  mbme  bande  de  frequence  (par  la  reduction  du  brouillage  mutuel  dO  au  blocage  par  paqueta 
des  rycepteur3  pendant  1' emission). 

3  -  CONSTITUTION  D'UN  TERMINAL  (figure  7) 

Un  terminal  est  const i tub  : 

-  des  rbcepteurs  d' acquisition, 

-  des  rbcepteurs  de  texte, 

-  de  l'ymetteur,  et 

-  des  dispositifs  de  traitement  des  signaux  et  des  messages. 

-  RECEPTEURS  O'ACqUISITION 

Un  terminal  complet  est  constitub  de  : 

-  rbcepteur  d' acquisition  b  bande  large  dans  le  canal  asynchrone, 

-  rbcepteur  d' acquisition  b  bande  large  dans  les  canaux  synchrones  organises  par  division 
en  temps, 

-  rbcepteur  d' acquisition  b  bande  etroite  dans  les  canaux  synchrones  dont  1 'utilisation 
est  faite  essentiellement  en  temps  de  paix  mais  qui  est  utilise  ygalement  dans  la  pbriode 
de  transition  pour  assurer  1' interoperability  avec  le  systbme  actuel  (il  peut  dans  ce  but 
btre  double). 

-  RECEPTEURS  PC  TEXTE 

-  les  rbcepteurs  de  texte  sont  b  bande  etroite  b  saut  de  frequence  identiques  aux  rbcepteurs 
du  systbme  actuel. 

A  cette  difference  que  le  taux  de  remplissage  des  messages  est  plus  faible  et  que  les 
receptions  entrelacbes  sont  possibles. 

-  le  nombre  de  ces  rbcepteurs  depend  de  la  classe  du  terminal, 

-  ils  ne  sont  programmes  qu'b  la  suite  de  reception  du  top  de  trame  d'acquisition  dans  un 
des  canaux  disponibles, 

-  ils  sont  utilises  suivant  la  priority  des  messages. 


-  EMETTEUR 

II  y  a  un  bmetteur  comroun  aux  deux  types  de  modulation 

-  bande  large  pour  le  preambule, 

-  bande  etroite  pour  le  texte. 

-  TRAITEHENTS 

Le  traitement  des  signaux  et  le  traitement  des  messages  sont  adaptds  b  la  nouvelle  modulation, 
nouvelle  forme  des  messages  et  nouvelle  organisation  des  canaux. 

4  -  CLASSE  DES  TERMINAUX 

Le  terminal  du  SINT AC-3  est  adaptable  dans  une  trfes  large  gamme,  b  partir  des  grandes  stations  C"5,  jusqu'au 
systbme  d'arme  b  trfes  courte  portbe  -portee  par  l'homme-  en  passant  par  tous  les  intermediates. 

II  e3t  utilise  d'une  fagon  regulibre  comme  le  systbme  multifonction  avec  une  antenne  omni-directionnelle, 
mais  ai  nbcessaire, 

-  il  peut  btre  utilise  avec  une  antenne  directive  et  pour  un  nombre  reduit  de  fonctions  et  b 
la  limite, 

-  il  peut  n'btre  utilise  que  pour  une  seule  fonction,  plus  specislement  pour  ^identification 
comme  un  systbme  specialise,  dont  la  configuration  est  simplifiee  en  consequence. 

Mais  avec  cette  caracteristique  fondamentale  que  1' interoperability  est  assurbe  entre  toutes  les  classes 
des  terminaux. 
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II  peut  de  ce  fait  fetre  parfaitement  adapts  b  la  pferiode  transitoire,  dans  laquelle  il  faut  assurer  la 
coexistence  et  la  compatibility  avec  les  systfemes  actuels  militaires  et  civils. 

Les  diffferentes  classes  de  terminaux  sont  caractyrisfees  par  : 

-  la  puissance  d'ymission  et  leur  portye, 

-  la  capacity  de  traitement  des  messages  et, 

-  la  teohnologie  suivant  le  type  de  porteur  :  sol,  air,  mer. 

Un  certain  nombre  de  terminaux  est  reprysenty  sur  les  planches  figures  8  b  12. 

SECURITE  O'  IDENTIFICATION  DANS  LE  SYSTEME  INTEGRE  MULTIFONCTION  PAR  RAPPORT  A  CELLE  DU  NIS 


-  Le  NIS  est  un  systfeme  spfecialisfe  qui  utilise  le  seul  procfedfe  d' identification  par  question  et  ryponse, 
en  cas  de  panne  1' identification  est  perdue. 

-  Le  SINTAC  utilise  plusieurs  procydys  d' identification  et  les  yquipements  redondants  : 

1.  identification  par  diffusion  : 

-  message  P  et  Identification  indirecte, 

2.  Identification  par  question  et  ryponse 

Les  deux,  dans  les  deux  families  de  canaux  : 

-  canal  asynchrone,  et, 

-  canaux  synchrones. 

Le  systfeme  utilise,  d'une  fagon  normale,  la  dysignation  interne  avec  la  position  fournie  par  le  systfeme 

de  navigation. 

Mais  en  cas  de  besoin,  on  peut  utiliser  l'antenne  directive  si  elle  est  disponible. 

-  la  capacity  d' identification  du  SINTAC  est  trfes  yievye  : 

-  1 1  identification  est  prioritaire, 

-  tous  les  rfecepteurs  d'un  terminal,  si  nycessaire,  peuvent  instantanyment  fetre  utilisys  pour 
1 1  identification , 

-  le  terminal  peut  rypondre  aux  interrogations  simultanyes  entrelacfees. 

Done,  sur  les  deux  points  : 

-  la  redondance  et  la  sycurity, 

-  la  capacity  instantanfee, 

le  systfeme  intdgrd  multifonction  prfesente  des  avantages  sur  le  systfeme  spycialisy. 

-  la  charge  d1 identification  par  question  et  rdponse  est  relativement  faible  car  elle  n'est  utilisfee  que 
pour  les  porteurs  inconnus, 

-  il  est  suffisant  de  rfeserver  dans  le  canal  synebrone  cinq  groupes  de  trois  rycurrences  pour  1 ' identification 
par  Q  et  R  (5  x  3  =  15  rycurrences  au  total)  pour  rfepondre  aux  besoins  de  sa  charge.  Cette  organisation  des 
rycurrences  permet  une  tolferance  d'erreur  de  synchronisation  de  +  4  ms  et  le  temps  d'accfes  est  <200  ms. 

-  la  figure  13  montre  1' organisation  en  temps  du  canal  synchrone  pour  1 ' identification  par  Q  et  R  avec  la 
tolferance  de  l'erreur  de  la  synchronisation. 

-  la  figure  14  reprfesente  1 1  organisation  avec  la  proportion  d' occupation  en  temps  du  canal  asynchrone  et  des 
canaux  synchrones,  pour  un  terminal  type  classe  II. 

SYSTEME  MULTIFONCTION  -  5ECURITE  DE  EQNCTIONNEMENT 

-  REDONDANCE  DANS  LE  SYSTEME, 

-  REDONDANCE  ENTRE  LES  SYSTEMES, 

Dans  le  SINTAC-3,  l'ensemble  des  fonctions  du  MIDS  et  du  NIS  est  rfealisfe  dans  la  bande  L  :  962  -  1215  MHz. 

L 'objection  est  faite  : 

-  qu'en  cas  de  panne  toutes  les  fonctions  sont  perdues  simultanyment,  et, 

-  qu'un  brouilleur  unique  peut  brouiller  l'ensemble  des  fonctions. 

Il  s'agit  en  fait  d'un  probifeme  yconomique  de  redondance  du  matyriel  et  de  redondance  entre  les  systfemes  : 

-  en  ce  qui  concerne  les  pannes,  la  configuration  du  systfeme  intfegrfe  est  telle  qu'elle  assure 
la  redondance  du  matyriel  dans  les  meilleures  conditions  feconomiques  que  dans  le  systfeme 
spfecialisy  car  la  mfeme  redondance  peut  servir  fe  plusieurs  fonctions. 

-  en  ce  qui  concerne  le  brouillage  du  systfeme  multi fonction  par  un  seul  brouilleur  tandis  que 
pour  deux  systfemes  spycialisfes,  dans  deux  bandes  diffferentes,  il  est  nfecessaire  d'avoir  deux 
brouilleurs  et  que  de  ce  fait  la  protection  est  meilleure,  i]  est  nfecessaire  d'examiner  en  fait 
le  rapport  du  coQt/efficacity  dans  les  deux  cas  :  le  rysultat  est  reprfesenty  dans  le  tableau 
ci-joint. 

On  peut  constater  que  la  protection  du  systfeme  multifonction  est  fequivalente  fe  celle  de  deux 
systfemes  spycialisfes  dans  deux  bandes  diffferentes  car  le  coflt  de  la  fonction  d'identification 
est  marginal  mais  que  l'alternative  du  NIS  en  bande  L  de  ce  point  de  vue  est  plus  dfefavorable, 
car  dans  ce  cas  le  coOt  du  systfeme  est  double  et  les  deux  peuvent  fetre  brouillfes  par  le  mfeme 
brouilleur. 
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Dans  le  cadre  du  systbme  intdgrd  multifonction,  il  eat  possible  par  contre  d'amdliorer  le  rapport  coOt/ 
effieacitd  du  systbme  en  rdalisant  la  redondance  du  matdriel  avec  des  Emissions  dans  deux  bandes  diffdrentes, 
par  exemple  :  bande  L  et  bande  S  ou  bande  UHF. 

Dans  ce  cas,  1' augmentation  du  coQt  du  systbme,  pour  assurer  la  redondance  par  rapport  au  coOt  de  la  redondan¬ 
ce  dans  la  mdme  bande  (la  seule  bande  L)  n'est  que  trbs  partielle,  elle  ne  concerne  essentiellement  que  les 
antennes,  et  la  partie  d'E/R  h  la  frequence  d‘ Emission,  tandis  que  le  coOt  du  brouilleur  double  car  il  faut 
un  brouilleur  dans  cheque  bande. 

Ainsi,  contrairement  b  1' objection  faite,  c'est  dans  le  cadre  du  systbme  intdgrd  multifonction  que  se  trouve 
la  solution  conduisant  au  rapport  coOt/efficacitd  optimal. 

La  redondance  partielle  peut  aussi  btre  rdalisde  entre  les  systbmes  de  communication  essentiellement  pour  la 
phonie,  comme  on  peut  le  voir  sur  la  figure  16. 

TEMPS  DC  PAIX,  DE  CRISE  ET  DE  GUERRE 

TEMPS  DE  PAIX  : 

-  seuls  les  rdcepteurs  b  bande  dtroite  sont  utilises, 

-  les  rdcepteurs  du  texte  sont  compl6t6s  d'un  circuit  d'acquisition  simplifid, 

-  le  processus  d'acquisition  utilise  : 

.  une  frequence  unique, 

.  un  code, 

.  avec  une  distribution  pseudo-aldatoire  en  temps,  la  mdme  utilisde  dans  le  SINTAC-3. 

TEMPS  DE  CRISE  ET  TEMPS  DE  GUERRE  : 

-  les  procddds  complets  du  SINTAC-3  sont  utilisds  2 

Le  programme  d'acquisition  b  large  bande  se  ddroule  en  permanence  (le  temps  de  paix  compris) 
et  il  est  disponible  sans  aucun  prdavis. 

PHASE  DE  TRANSITION  -  CONFIGURATIONS  OU  TERMINAL  (figure  17) 


1  -  Solution  actuellement  envisaqde 

Les  systfemes  inddpendants  :  le  JTIDS/SINTAC-2  et  le  NIS. 

2  -  Solutions  basdes  sur  le  SINTAC-3 

2.1.  Phase  transitoire  : 

-  JTIDS/SINTAC-2  sans  modification  et  en  plus  : 

-  SINTAC-3  :  dmetteur-rdcepteur  b  large  bande  du  prdambule  pour  acquisition  et  les 

fonctions  du  NIS. 

2.2.  Phase_ finale  i 

SINTAC-3  complet  remplissant  l'ensemble  des  exigences  du  MIDS  et  du  NIS. 


CONCLUSION 

INTERET  DE  LA  SOLUTION  ;  SINTAC-3 

-  Simplification  des  terminaux, 

-  Augmentation  de  la  capacitd  du  systbme  b  coOt  constant, 

-  Protection  contre  le  brouillage  du  canal  asynchrone, 

-  Protection  contre  le  brouillage  des  terminaux  simplifids, 

-  Diaponibilitd  100  5  du  canal  asynchrone  d' identification, 

-  Souplesse  d 'organisation  des  canaux  :  canal  asynchrone  et  canaux  synchrones,  par  l'utilisation  des  sous- 
canaux  ddfinis  dans  le  prdambule, 

-  Rdduction  de  la  charge  des  rdcepteurs  "texte"  et  des  traitements  de  message  par  la  prdddsignation  dans  le 
prdambule, 

-  Forme  du  message  :  prdambule  et  le  texte  d'un  taux  de  remplissage  suffisamment  faible  pour  admettre  dmission 
et  rdeeption  simultandes  entrelacdes  et  suffisamment  dense  pour  avoir  le  message  relativement  court 
permettant  le  temps  d' identification  court  ndeessaire  pour  la  configuration  air-air  et  pour  le  champ  de 
bataille, 

-  Discrdtion  des  dmissions  est  optimisde  : 

.  le  prdambule  b  bande  large  est  plus  discret  que  le  prdambule  b  bande  dtroite, 

.  le  texte  b  bande  dtroite  est  inchangd  mais  il  est  dmis  avec  les  sauts  de  frdquences  b  chaque 
impulsion. 

-  Forme  du  message  avec  le  prdambule  B  ddfinissant  par  le  mot  "MOOE"  le  type  de  message  (ou  le  sous-canal) 
et  par  le  mot  "PREDESIGNATION"  le  correapondant  ou  la  zone  intdressde, 

.  assure  une  disponibilitd  dlevde,  sans  une  organisstion  rigide, 

.  rdduit  sensiblement  la  charge  de  traitement  des  textes  par  l'dlimination  prdalable  des  textes 
non  utiles. 


-  Entree  au  rfeseau  : 


.  utilisation  du  canal  asynchrone  reduit  considerablement  Ip  temps  d'entrfee  au  rfeseau  et 
simplifie  la  procedure. 

-  Localisation  par  les  messages  P 

.  la  capacity  plus  grande  du  terminal  SINTAC-3,  de  mfeme  que  la  possibility  de  reception  des 
messages  entre laces  permet  : 

-  soit  d'augmenter  la  periodicity  de  reception  du  message  P  et  augmenter  la  precision  de 
localisation,  qui  pourra  etre  utile  dans  la  fonction  d'anl icol lision, 

-  soit  de  rdduire  la  periodicity  des  emissions  ce  qui  reduit,  pour  la  meme  periode  de 
renouvellement  de  reception,  la  charge  du  reseau. 

-  Facility  d'utilisation  du  systfeme 

.  organisation  des  canaux  simplifiee  qrSce  A  la  forme  du  message  aui  permet  emission  et  reception 
simultanees  entrelacees. 

C'est  trfes  important  pour  la  transmission  par  relais  ou  le  canal  unique  fe  plusieurs  sous-canaux 
peut  6tre  utilise  sans  organisation  mutuelle  et  avec  une  disponibilite  de  100  %. 

-  Compatibility  avec  IFF/5SR  actuel  et  avec  TACAN/DME 

satisfaisante  grSce  &  remission  fe  bande  large  du  seul  preambule  qui  reste  suffisamment  court  pour  ne  pas 
brouiller  ni  1'IFF  ni  le  TACAN. 

-  Interoperability  avec  le  JTIOS  (SINTAC-2)  peut  etre  assuree  dans  la  periode  de  transition, 

.  soit  que  le  JTIDS  (SINTAC-2)  soit  complete  par  des  circuits  d'acquisition  fe  bande  large  et 
le  logiciel  complete  en  consequence, 

.  soit  que  le  SINTAC-3  soit  muni  des  circuits  d'acquisition  fe  bande  etroite  (pour  la  classe  2, 

2  recepteurs  par  antenne)  et  ygalement  le  logiciel  complete  en  consequence. 

-  Fonctionnement  temps  de  paix,  temps  de  guerre 

En  temps  de  paix,  seule  l'acquisition  en  bande  etroite  est  utilisee 

.  le  programme  des  canaux  fe  bande  large  se  deroule  d'une  fagon  continue  mais  il  n'est  pas  utilise 
-avec  seule  exception  pour  1' identification  par  0  et  R-  dont  la  charge  est  trfes  faible. 

.  ceci  rend  disponible  le  systfeme  a  passer  en  fonctionnement  de  temps  de  guerre  instantanement 
sans  aucun  preavis,  seule  contrainte  est  celle  de  la  responsabilite  operationnelle. 

.  cette  procedure  assure  le  maximum  de  security  et  de  discretion  du  systfeme  en  temps  de  paix. 

ADDENDUM  :  COMPATIBILITE  DES  SYSTEMES  DANS  LA  BANDE  L 


Depuis  la  redaction  du  texte  de  cette  conference,  nous  avons  examine  le  probifeme  de  compatibility  entre 
les  differents  systfemes  utilises  en  bande  L  : 

-  systfemes  militaires  existants  :  TACAN  et  IFF  MK  10, 

-  systfemes  civils  en  dfeveloppement  :  DABS, 

-  systfemes  militaires  futurs  en  etude  et  de  dfeveloppement  : 

.  NIS  bande  t, 

.  JTIDS  -  TDMA  et  DTDMA 
.  SINTAC-3. 

Nous  prfesentons  ici  la  matrice  rfesumant  les  rfesultats  obtenus  dans  les  configurations  opferationnelles 
examinees  qui  nous  semblent  significatifs  et  qui  incitent  fe  des  examens  plus  approfondis. 

On  peut  constate r  que  : 

1  -  Les  systfemes  existants  :  le  TACAN  et  1 ' IFF  MK  10  (12)  sont  compatibles  avec  d'autres  systfemes 

mais  leurs  performances  ou  leurs  protections  contre  le  brouillage  ne  sont  pas  suffisantes  et  c'est 
la  raison  pour  laquelle  il  faut  chercher  de  nouveaux  systfemes. 

2  -  Le  DABS  est  compatible  aussi  avec  les  autres  systfemes.  Il  pourrait  cependant  avoir  des  probifemes 

avec  le  NIS  bande  L  suivant  la  conception  et  I'utilisation  de  ce  dernier.  Il  s’agit  lfe  d'un  systfeme 
civil  ne  rfepondant  pas  aux  besoins  militaires  ni  de  security  ni  de  protection  contre  le  brouillage 
pour  lequel  il  ne  se  pose  que  le  problfeme  de  compatibility. 

3  -  Le  NIS  bande  L  est  par  contre  envisage  pour  assurer  un  haut  niveau  de  secret  et  de  protection 

contre  le  brouillage.  Le  produit  Bande  x  Temps  (BxT)  des  impulsions  est  felevfe  et  en  fonctionnement 
autonome,  sa  charge  en  communication  apparait  incompatible  avec  le  JTIDS  TDMA.  Il  s'agit  de 
blocage  (du  temps  mort)  des  recepteurs  de  tous  les  systfemes  en  bande  L,  pendant  1' emission  de 
n'importe  lequel  d'entre  eux. 

Avec  les  messages  compacts  relativement  longs  du  NIS,  le  brouillage  du  JTIDS  TDMA  par  paquets 
depasse  la  capacity  de  correction  d'erreurs  du  JTIDS  et  les  messages  brouillfes  sont  perdus. 

Oans  le  cas  du  JTIDS  DTDMA  les  messages  sont  distribufes  et  le  brouillage  par  paquet  est  limite 
fe  un  nombre  faible  de  symboles  que  le  code  de  correction  d'erreur  peut  reconstituer,  d'ou  la  compa¬ 
tibility  indiqufee  entre  le  NIS  bande  L  et  le  JTIDS  DTDMA. 

4  -  Le  JTIDS  TDMA  comme  le  JTIDS  DTDMA  peut  6tre  utilise  pour  l'identification,  qu'il  peut  remplir  de 

diffferentes  fagons  :  messages  P,  identification  indirecte  et  par  question  et  rfeponse  mais  dans  ce 
dernier  cas,  ils  n'ont  pas  toutes  les  performances  exigfees  par  le  NIS  comme  c'est  indique  dans  le 
tableau.  Il  eat  indispensable  de  les  completer  dans  un  certain  nombre  de  configurations  par  un 
3ystfeme  specialise,  rfepondant  aux  specifications  du  NIS,  1 'ensemble  restant  compatible. 


.J 
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Un  tel  systAme  c6tA  NIS  pourrait  Atre  le  NIS  bande  S  compatible  ausai  bien  avec  le  JTIDS  TOMA  que 
D T DMA ,  mais  il  pose  des  problAmes  trAs  difficiles  dans  la  pAriode  de  transition  A  cause  du  besoin 
d’antennes  supplAmentaires  en  bande  S.  Oe  ce  point  de  vue,  il  y  a  tout  intArAt  4  utiliser  la  bande  L 
pour  les  deux  systAmes  :  le  MIDS  et  le  NIS. 

5  -  La  solution  peut  Atre  recherchAe  dans  la  combinaison,  JTIDS  DTDMA  +  NIS  bande  L.  Les  deux  systAmes 

sont  compatibles  mais  certaines  performances,  hachurAes  dans  le  tableau,  sont  assez  tangentes. 

Il  y  a  intArAt  A  chercher  A  optimiser  cet  ensemble. 

6  -  Le  SINTAC-3  utilise  les  messages  distribuAs  pour  1 'ensemble  des  fonctions  aussi  bien  du  NIS, 

1' identification  par  question  et  rAponse,  que  le  MIDS.  Le  temps  de  blocage  pendant  1' Amission  est 
court  distribuA  alAatoirement  de  la  sorte  qu'on  ne  perde  jamais  plus  d'un  symbole  A  la  fois  et  la 
perte  totale  dans  un  message  reste  faible  compatible  avec  le  code  de  correction  d'erreur,  le  taux 
de  perte  du  message  est  trAs  faible,  parfaitement  compatible  avec  les  besoins  opArationnels  ausai 
bien  du  NIS  que  du  MIDS. 

Les  messages  du  SINTAC-3,  bien  que  distribuAs  sont  suffisamment  courts  pour  que  1 'entrelacement 
des  messages  soit  rare  et  s'il  arrive,  il  ne  dApasse  qu'exceptionnellement  2  A  3,  ce  qui  simplifie 
sensiblement  la  gestion  du  systAme. 

Le  SINTAC-3  est  le  systAme  de  la  catAgorie  du  systAme  global  :  NIS  bande  L  +  JTIDS  DTDMA  mais 
optimise  : 

-  le  message  est  distribuA  aussi  bien  pour  le  NIS  que  pour  le  MIDS  d’ou  la  reduction  du 
brouillage  par  paquet  et  de  la  perte  de  messages  ce  qui  rend  compatible  le  NIS  et  le  MIDS 
dans  la  mAme  bande  (bande  L), 

-  le  prAambule  est  court  gr&ce  A  la  modulation  A  trAs  large  bande  ce  qui 

rAduit  la  longueur  du  message  et  le  nombre  de  messages  entrelacAs  et  qui  simplifie  la  gestion 
du  systAme, 

-  le  prAambule  8  est  utilisA  pour  la  prAsAlection  du  sous-canal  ("MODE")  et  du  porteur  intAressA 
par  le  message  ("PREOESIGNATION") ,  ce  qui  soulage  considArablement  le  traitement  du  texte 
(une  proportion  trAs  faible  Atant  destinAe  au  porteur). 

-  le  dAcodage  du  prAambule  est  du  type  passif  (on  dAtecte  le  code  attendu)  comme  dans  1' identi¬ 
fication  MK  10  (mode  A  du  5SR)  ce  qui  donne  un  pouvoir  de  separation  AlevA  ( thdoriquement 

I  chip)  aussi  bien  A  1' interrogation  qu'A  la  rAponse. 

II  est  possible  de  decoder  un  grand  nombre  de  messages  entrelacds  ;  la  limite  etant  donnAe 
par  l'dtouffement  des  messages  et  le  nombre  de  circuits  prAvus  pour  le  dAcodage. 

-  dans  la  pAriode  de  transition  cependant,  il  peut  Atre  demande  au  SINT AC  A  1' interrogation 
d'envoyer  le  message  de  predesignation  en  coordonnees  directives  relatives  par  rapport  A 
l'interrogateur.  Leur  decodage  ne  peut  Stre  qu'actif  (decoder  l'information  envoyAe,  comme 
dans  le  mode  C  du  SSR).  Dans  ce  cas,  avec  la  modulation  PPM  (utilisAe  dans  le  SINTAC-3) 

le  pouvoir  de  separation  diminue  (passe  A  la  longueur  de  1' impulsion)  et  le  nombre  d'entre- 
lacements  acceptables  ne  dApasse  pas  2  A  3  : 

.  ceci  pourrait  Atre  tangent  ou  insuffisant,  cAtA  interrogateur, 

.  cAtA  rAponse,  il  n'y  a  pas  de  problAme,  le  dAcodage  est  passif  et  le  pouvoir  de  separa¬ 
tion  3uffisant  permet  un  grand  nombre  de  messages  entrelacds. 

Pour  Aliminer  cette  objection  au  SINTAC-3,  nous  avons  envisage  une  nouvelle  version  mainte- 
nant  le  pouvoir  de  separation  AlevA,  Agal  A  un  chip,  mfeme  en  ca3  de  dAcodage  actif  du 
prAambule  B. 

C'est  une  possibilitA  qui  augmente  encore  la  souplesse  d' utilisation  du  SINTAC-3  mais  qui 
complique  lAgArement  le  rAcepteur  et  ne  sera  utilisAe  que  si  effectivement  elle  se  justifie 
opera t ionnel lement . 

CONCLUSION 


1  -  Cette  Atude  de  compatibilitA  des  systfemes  en  bande  L  indique  que  seuls  deux  systfemes  sont 

susceptibles  de  rApondre  simultanAment  dans  un  porteur  aux  besoins  du  NIS  et  du  MIDS  : 

1.  NIS  bande  L  +■  JTIDS  DTDMA 

2.  SINTAC-3  V-2  ou  si  nAcessaire  V-3. 

Le  SINTAC-3  nous  apparait  comme  la  version  optimisAe  du  premier.  Mais  dans  les  deux  cas, 
une  Atude  plus  dAtaillAe  du  systAme  est  nAcessaire. 

2  -  De  cette  Atude  apparait  aussi  qu'il  est  indispensable  d'examiner  la  compatibilitA  entre 

tous  les  systAmes  utilises  simultanAment  dans  un  porteur  et  de  les  dAfinir  compte  tenu  de 
cette  compatibilitA. 

Ceci  peut  conduire  aussi  bien  A  l'adaptation  des  systAmes  qu'A  une  modification  de  speciali¬ 
sation  des  systAmes  en  tenant  compte  de  leur  coexistence. 

Cette  Atude  globale  pourrait  concerner  non  seulement  la  compatibilitA  des  systAmes  mais 
aussi  leur  complAmentaritA  et  leur  redondance  et  rApondre  ainsi  au  thAme  de  ce  symposium  : 

"LA  TECHNOLOG IE  DES  SYSTEMES  HAUTEMEN1  INTEGRES". 

Mais  cette  integration  devrait  s'Atendre  A  l'Atude  des  diffArents  systAmes  dans  l'esprit  de 
leur  integration  ;  elle  doit  done  concerner  aussi  le  concept  des  senseurs  et  ne  pas  se 
limiter  seulement  A  leur  utilisation  intAgrAe. 

Il  y  a  1A  une  optimisation  A  faire  aussi  bien  du  point  de  vue  de  la  sAcuritA  que  de  Is  dispo- 
nibilitA  et  du  meilleur  rapport  coOt/efficacitA  du  systAme  durant  la  vie  du  porteur. 
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Fig.l  Complexity  relative  des  terminaux  JT1DS/SINTAC  2  et  S1NTAC  3 


3JCfTH>rcor>o 


PR0TEC7T0*  CONTRt  L£  8R0UILLAQB 
EN  dS 


Syfttnw  JT1  PS/51  N tag  Z  t  Wig  tnotutiwiiro 

ANTENNES  SUPERIEURES  POUR 
ANTENNE  SUPERIEURE  ROUR  :  R6CEPTEURS  BANDS  HAUTE 

RECEPTEUR  8ANDE  BASSE  1  ET 
EMETTEUR  /  RECEPTEUR  BANOE  BASSE  2 


RECEPTEUR 
BANOE  BASSE  1 


ANTENNE  SUPERIEURE 
JTIDS  /  SINT  AC  2 


ANTENNE  DIRECTIVE 
□'INTERROGATION  DANS 
LA  BANOE  HAUTE 


ANTENNE  RADAR 
PRIMAIRE 


ANTENNE  BASSE 
JTIDS/SINTAC  2 


EQUIPEMENT  DE 
NAVIGATION 


ANTENNE  INFERIEURE  POUR  : 
RECEPTEUR  BANDE  BASSE  1  ET 
EMETTEUR  /  RECEPTEUR  BANDE  BASSE  2  I 


-  3  antannes  hauces 
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Fig.3(b)  Equipements  avions  du  MIDS  ct  du  NIS 


IDENTIFICATION  AIR-AIR 


SURFACE  DE  SEPARATION 


Fig.4  Surface  de  separation  dans  les  deux  modes  de  designation  directif  (9,  A 8) 
et  par  position  absolue  (X,  Y;  Ax,  Ay) 


VERSION  2  :  INTERNAL  DESIGNATION 


VERSION  2  :  EXTERNAL  DESIGNATION 


Fig. 5  Message  format 
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Fig.8  Terminal  A2 


Fig.9  Terminal  B4 
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Fig.  10  Terminal  B6 


(C.G.):  Commands  do  gain  das  2  amplis  par  la  voia  Z 
(S.R.):  Signal  da  rtfdranca  commun  aux  2  convolutaurs 
(C1,C1):L#s  2  convolutaurs  idantiquas  montds  sur  la  m4ma  substrat 


Fig.  12  SINTAC  3  B7  (RSLS)  -  Pour  utilisation  avec  antenne  directive  et  ISLS  +  RSLS 


SYNCHRO  ERROR  :-4mi 


SYNCHRONOUS  IDENTIFICATION  CHANNEL  ORGANIZATION 


Fig.  13  Identification  -  Canal  synchrone 
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Fig.  14(a)  Systdme  multifonctions  a  deux  bandes:  bande  L  et  bande  S 
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-  LES  RECEPTEURS  BANOE  LARGE  CANAL  SYNCHRONE  ET  CANAL  ASYNCHRONE  SONT  INTERCHANGEABLES 

-  LES  RECEPTEURS  OE  TEXTE  SONT  INTERCHANGEABLES 

-  SEULS  LES  ETAGES  R.F.  SONT  PARTICULARS  EN  BANOE  S  ET  EN  BANOE  L 

-  CE  TERMINAL  ASSURE  TOUTES  LES  FONCTIONS  DE  COMMUNICATION,  DE  NAVIGATION  ET  D'IDENTIFICATION 
PAR  DIFFUSION  ET  PAR  Q  ET  R  EN  BANC  t  L  ET  EN  BANOE  S  SUIVANT  L'ORGANISATION  OES  CANAUX  ET  LA 
SECURITE  OEMANOEE. 


Fig.  15  Schema  synoptique  du  terminal  a  deux  bandes:  L  et  S 


CANAUX  SINTAC 


16  Types  de  liaisons  suivant  le  porteur 


SINT  AC  2  ±  NIS  SINTAC  3 

PHASE  TRANSITOI RE  I  PHASE  FINALE 


wivant  le  concept  actual  SINTAC  3  -  Equipement  indipendant  pour  ('acquisition  SINTAC  3-  Logiciel  assurant 

Calculateur  logiciel  interface  SINT  AC  3  I'intiropirabilitA  avec  les  terminaux 

en  phase  transitoire 


SYSTEME 


COMPATIBILITE 


PERFORMANCES 


(T)  PERFORMANCES  VALABLES,  COMPATIBLES 
Q  INSUFFISANT,  INCOMPATIBLE 
£  PERFORMANCES.  COMPATIBILITE  TANOENTE 

gj  NE  SONT  PAS  UTILISES  SIMULTANEMENT  OU  N'EST  PAS  UTILISE  POUR  CETTE  FONCTION 


Compatibility  entre  1’ensemble  des  systemes  dans  la  bande  L 
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1  -  IMPROVEMENT  TO  THE  CURRENT  SYSTEM  JT IDS/S  I NTAC‘2 


After  a  careful  analysis  of  the  JTIDS/S1NTAC-2  performances  and  the  N1S  operational  requirements,  we 
came  to  the  conclusion  that  the  following  improvements  have  to  be  added  to  JT 1DS/S1NTAC-2  terminals. 

-  MIPS  side 

.  simplify  the  acquisition  circuits, 

.  increase  terminal  capacity, 

.  increase  terminal  utilization  versatility  with  different  message  .  formats  -compact  or  distributed, 

.  maintain  jamming  protection  for  simplified  terminals, 

.  allow  terminal  simplification  for  small  platforms. 

-  NIS  side 

.  use  of  the  asynchronous  channel  for  identification  by  Q  and  A, 

.  have  near  to  100%  availability  for  identification  by  Q  and  A, 

.  be  able  to  simplify  the  multifunction  terminal  to  cover  only  the  identification  by  Q  and  A 
function,  if  required,  without  diminushing  the  terminal,  by  keeping  it  interoperable  with  all 
the  multifunction  terminals. 

These  characteristics  are  added  to  the  existing  characteristics  on  the  SINTAC-1  and  SINTAC-2  for  ease 
of  installation  on  platforms,  as  the  internal  designation  means  it  is  no  longer  necessary  to  use  the  directio¬ 
nal  antenna  for  interrogation. 

But  that  does  not  exclude  the  use  of  directional  antenna,  either  for  designation  or  only  to  increase 
the  protection  against  jammers  if  necessary. 

This  is  an  additional  capability  of  the  system  which  : 

.  allows  IFF  function  on  the  platform  on  which  good  performances  directional  antenna  cannot  be 
installed, 

.  improve  in  most  case  performances  in  separation  capability, 

.  increase  reliability  and  security, 

.  simplify  the  terminal  (volume  and  cost). 

NEW  CONCEPT  :  SI NT AC- 3 

-  modification  of  the  acquisition  process  :  based  on  very  large  spread  spectrum  modulation  according 
to  the  technique  proposed  for  NIS, 

-  keeping  the  text  modulation  process  without  modification  according  to  the  JTIDS/SINTAC-2  technique, 

-  interoperability  with  JTIDS/SINTAC-2. 

TERMINAL  COMPLEXITY  (figure  1) 

This  view  showsthe  relative  complexities  of  the  JTIDS/SINTAC-2  class  II  terminal  and  a  SINTAC-3 
terminal  with  a  similar  capacity  and  a  similar  anti-jam  protection. 

Using  8  receivers  for  acquisition  -8  are  needed  for  a  good  protection  against  jamming  of  the  preambie- 
but  limited  to  the  reception  of  only  one  text  at  a  time. 

§INIAC:3JQyiVALENIJAPACnYJERMINAL  : 

Using  1  reception  chain  split  into  two  parts  :  J 

.  1  for  preamble  acquisition, 

.  1  for  text  reception, 

with  the  same  protection  against  jamming  due  to  the  use  of  a  80  MHz  bandwidth  for  the  acquisition 
preamble. 


ANTI-JAM  PROTECTION  OF  THE  ASYNCHRONOUS  CHANNEL  {figure  2) 

The  figure  shows  a  schema  of  the  protection  against  jamming  of  the  asynchronous  channel  and  the 
improvement  gained  by  SINTAC-3  over  JTIDS/SINTAC-2  solution. 

ABOVE  :  large  spread  spectrum  modulation  and  jamming  range  for  all  types  of  jammer-1,  smart  jammer 
included. 

BELOV/  :  narrow  spread  spectrum  modulation  and  jamming  range  for  a  smart  jammer. 

Total  energy  of  jamming  is  identical  in  both  case*. 

HARDWARE  COMPLEXITY  AND  CORRESPONDING  INSTALLATION  DIFFICULTY  (figures  3a  et  3b) 

-  On  the  figure  3a  are  represented  the  operational  configurations  on  which  the  aircraft  can  be  utilized. 

-  On  the  figure  3b  above  are  represented  all  eguipments  needed  to  fulfill  the  M1DS  and  NIS  reguirements 
on  the  aircraft  : 

.  JTID5/SINTAC-2  eguipment, 

with  upper  and  lower  antenna, 

.  Inw  band  1 ,  receiver  and 
.  low  bund  2,  transceivers, 

with  upper  and  lower  common  antennas, 

.  high  band  : 

—  receiver  with  3  upper  and  3  lower  antennas  to  have  a  good  diagram, 

—  emitter  with  directional  antenna  in  the  nose  of  the  aircraft. 

-  On  the  picture  below  is  represented  the  SINTAC-3  which  has  the  required  capability  of  M1DS  and  MS 
using  the  information  delivered  by  the  navigation  system  already  implemented  on  the  aircraft,  but 
not  used  by  the  dedicated  systems  (descripted  above). 

In  this  system  hard  and  soft  arangements  are  such  that  the  terminal  can  provide  the  required  reliabi¬ 
lity. 

DISCRIMINATION  ACCURACY  (figure  4) 

The  picture  shows  the  advantages  of  the  internal  designation  over  the  external  designation  for  identifi¬ 
cation  by  0  and  A. 

RANGE  :  BO  NM 

EXTERNAL  DESIGNATION  WITH  DIRECTIONAL  ANTENNA  : 

-  with  a  beamwidth  of  4° 
provides  : 

.  lateral  discrimination  :  6  NM 
.  distance  discrimination  :  100  ft 

INTERNAL  DESIGNATION  USING  A  NAVIGATION  SYSTEM  : 


-  with  an  average  accuracy  of  0.5  NM 
provides  : 

.  lateral  discrimination  :  0.5  NM 
.  distance  discrimination  :  100  ft 

Internal  designation  provides  better  discrimination  accuracy  and  its  installation  and  cost  advantages  are 
evident . 

2  -  SINTAC  CONCEPT 
MESSAGE  FORMAT  :  figures  5  and  6 

The  message  contains  two  parts  : 

-  the  preamble, 

-  the  text. 

The  preamble  has  three  functions  : 

-  message  acquisition, 

-  subchannel  differentiation, 

-  predesignation  of  the  correspondent (s)  by  zone,  or  individually. 


*  The  wide  band  being  reduced  from  100  MHz  to  R0  MHz.  Here  is  a  reduction  of  1  dB  in  gain  approximately. 
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To  perform  these  functions,  the  preamble  is  divided  into  two  parts  : 

-  preamble  A,  consisting  of  the  acquisition  frame, 

-  preamble  8,  consisting  of  two  words  : 

.  “MODE"  defining  the  subchannel, 

.  "PREOESIGNATION"  indicating  the  applicable  zone  or  providing  the  individual  code  of  the 
correspondent . 

The  text  : 

-  gives  the  precision  synchronization, 

-  clears  up  any  ambiguities  that  the  predesignation  might  have  left, 

-  provides  the  message  information. 

-  the  preamble  pulses  are  modulated  through  a  wide  band, 

-  the  text  pulses  are  modulated  through  a  relatively  narrow  band,  the  same  as  for  the  JTIDS  or  SINT  AC— 2 , 

-  the  preamble  and  text  pulses  are  transmitted  in  "pages"  with  : 

.  low  filling  rate, 

.  pseudo  random  (defined  by  channel)  pulse  position  in  the  page. 

The  preamble  and  text  filling  rates  are  designed  to  : 

-  allow  simultaneous  interlaced  transmission  and  reception  without  major  loss,  with  also  allows 
for  possible  interlaced  messages  reception  in  the  same  channel, 

-  to  have  sufficiently  short  messages  to  meet  identification  by  0  and  A  requirements. 

This  message  format  : 

-  increases  terminal  availability, 

-  greatly  simplifies  channel  organization, 

-  improves  the  compatibility  between  the  independent  systems  on  the  same  platform  functioning  in 
the  same  frequency  (by  the  reduction  of  the  mutual  packet  blanking  of  the  messages  during  the 
transmission) . 

3  -  TERMINAL  COMPOSITION  (figure  7) 

A  terminal  consists  of  : 

-  acquisition  receivers, 

-  text  receivers, 

-  the  transmitter, 

-  signal  and  message  processing  devices. 

-  ACQUISITION  RECEIVERS  : 

A  complete  terminal  includes  : 

-  wide  band  acquisition  receives  in  the  asynchronous  channel, 

-  wide  band  acquisition  receives  in  the  synchronous  channels,  organized  on  a  shared  time  division 
basis, 

-  narrow  band  acquisition  receives  in  the  synchronous  channels  ;  used  mainly  in  peace  time,  but 
also  during  the  transition  period  to  assure  interoperability  with  the  current  system  (it  can  be 
backed  up  for  this  purpose). 

-  TEXT  RECEIVERS  : 

-  these,  narrow  band  frequency  hoping  receivers,  are  identical  to  the  receivers  in  the  current 
system,  except  for  the  filling  rate  which  is  lower,  and  for  the  possibility  of  interlaced 
receptions. 

-  the  number  of  these  receivers  depends  on  the  terminal  class, 

-  they  are  programmed  only  after  the  acquisition  frame  pulse  is  received  in  one  of  the  available 
channels, 

-  they  are  used  per  message  priority. 

-  TRANSMITTER  : 

A  common  transmitter  is  used  for  both  typee  of  modulation  : 

-  wide  band  for  the  preamble, 

-  narrow  band  for  the  text. 

-  PROCESSING  : 

The  signal  and  message  processing  is  adapted  to  the  new  modulation,  the  new  message  format  and  the  new 
channel  organization. 


4  -  TERMINAL  CLASSES 


The  SINTAC-3  terminal  can  be  adapted  to  a  very  ranqe  of  stations)  from  large  stations  down  through 
all  the  intermediate  platforms  to  the  very  short  range  man-pad  weapon  system. 

It  is  regularly  used  as  the  multifunction  system  with  omnidirectional  antenna,  hut  if  t •gulled  : 

-  it  can  be  used  with  a  directional  antenna  and  for  a  reduced  number  of  functions, 

-  or,  if  absolutely  necessary,  it  can  be  used  for  a  single  function  particularly  as  a  specialised 
identification  system,  with  the  consequent  configuration  simplification,  but  with  the  fundamental 
characteristic  that  interoperability  is  provided  among  all  terminal  classes. 

For  this  reason,  it  can  be  adapted  perfectly  well  to  the  transition  period  when  coexistence  and  compati¬ 
bility  must  be  provided  between  current  military  and  civilian  classes. 

The  various  terminal  classes  are  distinguished  by  : 

-  their  transmission  power  and  range, 

-  message  processing  capacity, 

-  technology  depending  on  platform  type  :  land,  sea,  air. 

A  certain  number  of  terminals  are  shown  in  the  pictures  ft  to  12. 

IDENTIFICATION  SECURITY  IN  THE  INTEGRATED  MULTIFUNCTION  SYSTEM  IN  RELATION  TO  THAT  OF  THE  N1S 


-  The  NIS  is  a  specialized  system  using  only  the  question  and  answer  identification  process.  In  cases  of 
failure  the  identification  is  lost. 

-  the  SINTAC  used  several  identification  processes  and  redundant  equipment  : 

1.  Identification  by  "broad  cast"  : 

.  P  messages  and  indirect  identification. 

2.  Identification  by  Q  and  A  : 

,  both  in  the  two  channels  families  : 

-  asynchronous  channel, 

-  synchronous  channels. 

The  system  normally  uses  internal  designation  with  the  position  provided  by  the  navigation  system  ; 
but  if  required  the  directional  antenna  is  available  for  this  purpose. 

-  The  SINTAC  identification  capacity  is  very  high  : 

.  identification  has  priority, 

.  all  terminal  receivers  can  be  switched  instantaneously  to  identification  required, 

.  the  terminal  can  respond  to  interlaced  interrogations. 

Therefore,  concerning  : 

.  redundancy  and  security, 

.  instantaneous  capability. 

the  integratedmulti function  system  offers  advantages  ever  the  specialized  system  : 

.  the  Q  and  A  identification  is  relatively  low  as  it  concerns  only  unkown  carriers 
.  five  groups  of  three  basic  time-slots  can  be  reserved  in  the  synchronous  channel  for  the  Q  and  A 
identification  (i.e.  15  time-slots)  to  meet  load  requirements.  The  time  slot  organization  allows 
a  -  4  ms  synchronization  error.  Access  time  is  <  200  ms. 

The  figuresbelow  show  : 

.  figure  13  :  the  time  organization  of  the  Q  and  A  synchronous  identification  channel,  with  the 
tolerance  of  synchronization, 

.  figure  14  :  the  planned  organization  of  all  asynchronous  and  synchronous  channels  for  various 
class  II  equipment. 

MULTIFUNCTION  SYSTEM  -  SECURITY  OF  OPERATION 
REDUNDANCY  IN  SYSTEM, 

REDUNDANCY  AMONG  SYSTEMS 

In  the  SINTAC-3,  all  MIDS  and  NIS  functions  are  performed  in  the  L  band  (962-1215  MHz). 

The  objections  are  raised  : 

.  that  in  the  case  of  failure  all  functions  are  lost  simultaneously, 

.  and  that  a  single  jammer  can  jam  all  the  functions. 

This  comes  down  to  a  question  of  economy  involving  equipment  redundancy  and  redundancy  among  systems  : 

.  as  Far  as  failures  are  concerned,  the  integrated  system  configuration  is  such  that  it  assures 
equipment  redundancy  under  better  economic  conditions  than  the  specialized  system  because  the  same 
redundancy  can  provide  several  functions, 

.  as  far  as  concerns  the  jamming  of  the  multifunction  system  by  a  single  jammer,  while  two  speciali¬ 
zed  systems  in  different  bands  require  two  jammers,  the  cost  effectiveness  ratio  should  be  examined 
in  both  cases.  These  are  given  on  the  table  below. 

It  can  be  seen  that  the  protection  of  the  multifunction  system  is  equivalent  to  that  of  two  specialized 
systems  in  two  different  bands  because  the  cost  of  the  identification  function  is  marginal  ;  but  the  L  band 
NIS  alternative  is  unfavorable  from  this  point  of  view  because,  in  this  case,  the  cost  of  the  system  actually 
doubles  and  both  systems  can  be  jammed  by  the  same  jammer. 

The  solution  which  offers  the  maximum  operational  effectiveness  has  to  provide  redundancy  in  the  multi¬ 
function  system  operating  in  two  different  bands  e.q.  the  U.H.F.  or  S  band  and  l  band,  as  shown  in  the 
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figure  15  opposite  in  which  the  only  equipments  specific  to  a  band  are  the  R.F.  input  and  output  stages. 

In  this  case,  redundancy  of  the  equipments  can  be  optimized  ;  it  does  not  double  the  equipment  whereas 
the  jammer  must  be  doubled. 

The  partial  redundancy  can  also  be  realized  between  the  communication  systems  particularly  for  the 
voice,  as  shown  in  the  figure  16. 

WAR,  CRISIS  AND  PEACE  TIME 
PEACE  TIME 


-  narrow  band  receivers  only  are  used, 

-  narrow  band  receivers  are  fitted  with  a  simplified  acquisition  circuit, 

-  acquisition  process 

.  on  a  single  frequency, 

.  on  a  single  code, 

.  with  a  P.N.  time  distribution  according  to  SINTAC-3  preamble  organization. 

CRISIS  AND  WAR  TIME 

-  full  SINTAC-3  capacity  is  used, 

-  wide  band  acquisition  program  is  permanently  running  (even  in  peace  time)  and  available  without 
any  notice. 

TRANSITION  PHASE  -  CONFIGURATIONS  OF  TERMINAL  (figure  17) 

1  -  Current  solutionenvisaged 

Independent  JTIDS/SINTAC-2  and  N1S  equipments. 

2  -  Solutions  based  on  SINTAC-3 

2.1.  Transition  phase  : 

.  JTIDS/SINTAC-2  (not  modified), 
and  in  addition, 

.  SINTAC-3  :  wide  band  emission-reception  on  the  preamble  for  acquisition  and  MS  capability. 

2.2.  Final  phase  : 

SINTAC-3  complete  with  MIOS  and  NIS  capabilities. 

CONCLUSION  -  ADVANTAGES  OF  THE  SINTAC-3 

-  terminal  simplification, 

-  increase  in  system  capability  at  constant  cost, 

-  jammer  protection  in  the  asynchronous  channel, 

-  jammer  protection  of  simplified  terminals, 

-  100%  availability  of  the  asynchronous  identification  channel, 

-  flexible  channel  organization  :  asynchronous  and  synchronous  channels  by  using  sub  channels,  indicated 
in  the  preamble, 

-  reduction  of  the  load  text  receivers  and  message  processing  circuits,  by  use  of  predesignation  in  the 
preamble, 

-  message  format  :  preamble  and  text  with  sufficiently  low  filling  rate  to  allow  simultaneous  interlaced 
transmission  and  reception,  but  sufficiently  dense  to  have  a  relatively  short  message,  thus  allowing 
the  short  identification  time  required  for  the  air-air  configuration  and  for  the  battlefield, 

-  optimization  transmission  discretion  : 

.  the  wide  band  preamble  is  more  discreet  than  the  narrow  band  preamble, 

.  the  narrow  band  text  remains  unchanged,  but  it  transmitted  with  frequency  jumps  at  each  pulse. 

-  the  message  format  is  such  that  preamble  B  defines  (by  the  "MODE")  the  type  of  message  or  sub  channel 
and  (by  the  "DESIGNATION")  the  involved  correspondent  or  zone,  this  provides  : 

.  high  availability  without  a  rigid  organization, 

.  important  reduction  of  the  load  of  useless  text  processing. 

-  entry  in  net 

.  the  use  of  the  asynchronous  channel  considerably  reduces  the  time  for  net  entry,  and  also  simplifies 
the  procedure. 

-  localization  by  P  messages 

.  the  greater  capacity  of  the  SINTAC-3  and  the  possibility  of  receiving  interlaced  messages  mean 
that  : 

-  either  the  periodicity  of  P  message  reception  and  the  localization  precision  can  be 
increased,  which  could  be  very  useful  in  the  anticollision  function, 

-  or  the  transmission  periodicity  could  be  reduced,  thereby  reducing  for  the  same  period  of  the 
renewal  of  receptions,  the  network  load. 

-  ease  of  system  utilization 

.  this  channel  organization  is  simplified  by  the  message  format  which  allows  simultaneous  interlaced 
transmission  and  reception, 

.  thi9  is  very  important  for  identification,  but  also  for  voice  communication  where  it  is  possible 
to  talk  and  listen  simultaneously, 

.  it  is  also  important  to  relayed  transmissions  where  a  single  channel  with  several  sub  channels  can 
be  used  without  organization,  and  with  100%  availability. 
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-  compatibility  with  current  IFF/5SR  and  TACAN/SME  is  satisfactory  because  only  the  preamble  4s 
transmitted  in  wide  band  and  it  is  short  enough  not  to  jam  the  IFF  or  TACAN 

-  during  the  transition  period,  interoperability  with  the  JMDS  (3INTAC-2)  c  <n  be  ensured  by  : 

.  either  adding  the  necessary  wide  band  acquisition  circuitry  and  consequent  software  to  the 
JT IDS  (SINTAC-2), 

.  or  by  adding  narrow  band  acquisition  circuitry  to  the  SINTAC-3  (for  class  2  with  2  receivers 
per  antenna)  with  the  consequent  software. 

-  peace  time,  war  time  operation 

On  peace  time  only  the  narrow  band  acquisition  is  used  : 

.  the  wide  band  channel  program  runs  continously  but  is  used  only  for  identification  by  Q  and  A, 
where  the  load  is  low. 

.  this  means  the  system  is  available  for  instantaneous  changeover  to  war  time  operation  without 
forewarning,  the  only  constraint  being  operational  responsability. 

.  this  procedure  ensures  maximum  system  security  and  discretion  in  peace  time. 

ADDENDUM  :  SYSTEM  COMPATIBILITY  IN  THE  L  BAND 


Since  the  text  of  this  lecture  was  prepared,  we  have  examined  the  problem  of  compatibility  between  the 
various  systems  used  in  the  L  band  : 

-  military  systems  already  existing  :  TACAN  and  IFF  MK  10, 

-  civil  systems  being  developped  :  DABS, 

-  future  military  systems  being  studied  and  developped  : 

.  NIS  L  BAND, 

.  JT  IDS  -  TDMA  and  DTDMA, 

.  SINTAC-3 

We  show  here  the  matrix  which  recapitulates  the  results  obtained  with  the  operational  configurations 
examined.  They  seem  to  us  significant  and  call  for  more  thorough  examination. 

It  can  be  seen  that  : 

1  -  The  existing  systems,  TACAN  and  IFF  MK  10  (12)  are  compatible  with  other  systems  but  their 

performance  or  protection  against  jamming  is  insufficient  and  that  is  why  new  systems  must  be 
sought , 

2  -  The  DABS  is  also  compatible  with  other  systems.  However,  there  could  be  problems  with  the  NIS 

L  BAND  which  would  depend  on  the  design  and  use  of  the  latter.  This  is  a  civil  system  which  does 
not  satisfy  military  requirements  for  security  or  protection  against  jamming,  system  for  which 
only  the  problem  of  compatibility  arises. 

3  -  The  NIS  L  BAND  is  considered  however  as  it  provides  a  high  level  of  secrecy  and  protection  against 

jamming.  The  Band  x  Time  (BxT)  product  for  the  pulses  is  high  and,  in  independent  operation,  its 
communication  load  appears  to  be  incompatible  with  the  JTIDS  TDMA. 

It  is  a  question  of  blanking  (dead  time)  the  receivers  of  all  systems  in  the  l  BAND  during  trans¬ 
mission  from  any  one  of  them. 

With  the  compact,  relatively  long,  messages  of  the  NIS,  the  jamming  of  the  JTIDS  TDMA  by  packets 
exceeds  the  error  correction  capacity  of  the  JTIDS  and  the  jammed  messages  are  lost. 

In  the  case  of  the  JTIDS  DTDMA,  the  messages  are  distributed  and  the  jamming  by  packets  is  limited 
to  a  small  number  of  symbols  that  the  error  correction  code  can  reproduce  ;  this  gives  the 
compatibility  shown  between  the  NIS  L  BAND  and  the  JTIDS  DTDMA. 

A  -  The  JTIOS  TDMA,  like  the  JTIDS  DTDMA,  can  be  used  for  identification,  which  can  be  done  in  various 
ways  :  P  messages,  indirect  identification  and  interrogation  and  response  but,  in  this  last  case, 
the  full  performance  required  by  the  NIS  is  not  obtained  as  is  shown  in  the  table.  It  is  necessary, 
in  a  certain  number  of  configurations,  to  complete  this  with  a  specialized  system,  which  complies 
with  the  NIS  specifications,  while  the  whole  remains  compatible. 

Such  a  system  on  the  NIS  side  might  be  the  NIS  5  BAND,  which  is  compatible  with  both  the  JTIDS  TDMA 
and  the  DTDMA  but  it  causes  difficult  problems  in  the  transition  period  because  of  the  need  for 
additional  antennas  in  the  S  BAND.  From  this  point  of  view,  there  is  an  advantage  in  using  the  L 
BAND  for  both  systems,  the  MIDS  and  the  NIS. 

5  -  A  solution  may  be  found  in  the  combination,  JTIDS  DTDMA  +  NIS  L  BAND.  The  two  systems  are  compatible 

but  some  of  the  performance,  shown  shaded  in  the  table,  is  dubious.  It  would  be  advisable  to 
optimize  this  assembly. 

6  -  The  SINTAC-3  uses  distributed  messages  for  all  functions  for  both  the  NIS  identification  by  interro¬ 

gation  and  response,  and  the  MIDS.  The  blanking  time  is  short  and  its  distribution  is  random  so 
that  not  more  than  one  symbol  is  ever  lost  at  once  and  the  total  loss  in  a  message  remains  small, 
which  is  compatible  with  the  error  correction  code.  The  messaqe  loss  rate  is  very  small,  which  is 
fully  compatible  with  the  operations:  requirements  of  both  the  NI5  and  the  MIDS.  The  SINTAC-3 
messages  although  distributed,  are  .jfficiently  short  for  message  overlapping  to  be  rare  and, 
if  it  happens,  it  seldom  exceeds  2  to  5,  which  simplifies  system  management  considerably. 

The  5INTAC-3  is  in  the  global  system  cateoory  :  NIS  l  BAND  +  JTIDS  DTDMA  optimized  : 

-  the  message  is  distributed  both  for  the  NIS  and  the  MIDS.  This  gives  a  reduction  in  the  jam¬ 
ming  by  packets  and  in  messages  loss  and  makes  the  NIS  and  MIDS  compatible  in  the  same  band 
(L  BAND), 

-  the  preamble  is  short  thanks  to  the  very  wide  band  modulation.  This  reduces  the  message  length 
and  the  number  of  overlapping  messaqes.  It  simplifies  system  management. 

-  preamble  B  is  used  for  preselection  of  the  sub  channel  ("MODC")  and  of  the  carrier  concerned 
by  the  message  ("PREDESIGNATION").  This  lightens  text  processing  considerably  (a  very  small 
proportion  being  intended  for  the  carrier). 

-  decoding  of  the  preamble  is  of  the  passive  type  (the  code  expected  is  detected)  as  in  MK  10 
identification  (mode  A  of  thp  SSR).  This  gives  a  high  separating  power  (theorically  1  chip) 
both  in  interrogation  and  response. 

It  is  possible  to  decode  a  large  number  of  overlapped  messages,  the  limit  being  fixed  by  the 
choking  of  the  messaqes  and  the  number  of  circuits  provided  for  decoding. 
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!■-  During  the  transition  period  however,  the  SINTAC,  on  interrogation,  may  be  called  on  to  send 
the  predesignation  message  in  relative  directive  coordinates  with  respect  to  the  interrogator. 
Their  decoding  can  only  be  active  (decode  the  data  sent,  as  in  mode  C  of  the  SSR).  In  this 
case,  with  PPM  modulation  (used  in  the  SINTAC-3)  the  separating  power  decreases  (to  the  pulse 
length)  and  the  number  of  acceptable  overlaps  does  not  exceed  2  to  3. 

.  this  could  be  just  sufficient  on  the  interrogator  side, 

.  on  the  response  side,  there  is  no  problem.  The  decoding  is  passive  and  the  adequate 
separating  power  allows  a  large  number  of  overlapping  messages. 

To  counter  this  objection  to  the  SINTAC-3,  we  have  considered  a  new  version  which  retains  the 
high  separating  power,  equal  to  one  chip,  even  when  preamble  B  is  actively  decoded. 

This  is  a  possibility  which  increases  even  further  the  flexibility  of  the  SINTAC-3  in  use  but 
which  complicates  the  receiver  slightly  and  will  only  be  used  of  it  is  really  justified 
operationnaly. 

CONCLUSION 


1  -  This  study  of  compatibility  in  the  L  BAND  shows  that  only  two  systems  are  likely  to  satisfy  the 

requirements  of  the  NIS  and  MIDS  simultaneously  in  a  carrier  : 

1  -  NIS  L  BAND  +  JTIDS  DTDMA 

2  -  SINTAC-3  V-2  or,  if  necessary,  V-3. 

The  SINTAC-3  appears  as  the  optimized  version  of  the  first  one.  However,  in  both  cases,  a  more  detailed 
study  of  the  system  is  required. 

2  -  from  this  study,  it  appears  that  it  is  also  necessary  to  examine  the  compatibility  between  all  the 

systems  used  simultaneously  in  a  carrier  and  then  define  them  taking  this  compatibility  into  account. 

This  may  lead  not  only  to  an  adaptation  of  the  systems  but  also  to  a  modification  of  the  system 
specifications  to  take  their  coexistence  into  account. 

This  overall  study  could  concern  not  only  the  compatibility  of  the  systems  but  also  their  complemen- 
arity  and  redundance  and  cover  the  theme  of  this  congress  "THE  TECHNOLOGY  OF  HIGHLY  INTEGRATED 
SYSTEMS" . 

This  integration  should  be  extented  to  the  study  of  the  various  systems  in  the  spirit  of  their 
integration.  It  must  therefore  also  concern  the  design  of  the  sensors  and  not  limit  itself  to  their 
integrated  use. 

There  is  an  optimization  to  be  made  in  that  from  the  point  of  view  both  of  security  and  of  availabi¬ 
lity  as  well  as  of  the  best  cost/effectiveness  ratio  of  the  system  during  the  life  of  the  carrier. 
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lnd»p«ndMK  NIS  tnd  JTIDS  /  SINT AC 


UPPER  ANTENNA  FOR  : 
LOW  BAND  1  RECEIVER 
LOW  BAND  2  TRANSMITTER 


HIGH  BAND  RECEIVERS 
UPPER  ANTENNAS 


LOW  BAND  1  RECEIVER 


UPPER  JTIDS /SINT  AC  2  \ 

ANTENNA  \  N 

HB 

HIGH  BAND  TRANSMITTER . 
INTERROGATION  I  / 

AND  / 

LOW  BAND  2 
ANSWER  v  A 

RECEPTION  \  /kff  UJ 
DIRECTIONAL  \  AM) 

antenna  TvrCX^PtI  ^ 


LOW  BAND  2  A 
TRANSMITTER  v«\ 


PRIMARY  RADAR 
ANTENNA 


J  LB2  I 
'RECEIVER 


LOWER  JTIDS/  1 
SINT  AC  2  ANTENNA 


NAVIGATION 

EQUIPMENT 


LOWER  ANTENNA  FOR  :  IVUlllitiZti 

LOW  BAND  1  RECEIVER  *bout  o.i  ..coo 
LOW  BAND2TRANSMITTER  Q  1  A  procsss. 


HIGH  BAND  RECEIVERS 
LOWER  ANTENNAS 


- NOTA - 

**  The  3  upper  end  lower 
antennas  (High  Bead)  located 
above  and  under  the  vings  of 
the  aircraft  are  required  to 
avoid  any  large  notch  within 
the  antenna  pattern  at  this 
high  frequency  and  to  obtain 
an  identification  time  of 
about  0.1  second  for  a  £ul< 


PRIMARY  RADAR  ANTENNA 


Fig.3(b)  On  board  JTIDS/SINTAC  2  and  NIS  systems 


Fig.4  Compared  resolution  with  internal  and  external  designation  for  air  to  air  identification 
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VERSION  2  :  INTERNAL  DESIGNATION 


VERSION  2  :  EXTERNAL  DESIGNATION 


Fig.  5  Message  format 


Fig. 8  Terminal  A2 
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Fig. 9  Terminal  B4 


Fig.10  Terminal  B6 
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Fig.  11  SINT  AC  3  Terminal  B7  For  utilization  with  directional  antenna  and  1SLS 


(G.C.)  :  Gain  control  of  tha  2  amplifier*  by  the  I  channel 

(R.S.)  :  Reference  signal  common  to  both  convolvers 

(Ci ,  C'i )  :  2  identical  convolvers  mounted  on  the  same  substrate 


Fig.  1 2  SINT  AC  3  B7  (RSLS)  -  For  utilization  with  directional  antenna  and  1SLS-RSLS  devices 
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ORGANISATION  DU  CANAL  SYNCHRONE  D'IDENTIFICATION 


Fig.  ]  3  Synchronous  channel  identification 


-  OPERATION  SAFETY 

-  HOSTILE  JAMMING 


SYSTEM 

JAMMER 

SYSTEM/JAMMER  RATIO 

1 

JTIOS  LB 

NIS  SB 

LB  JAMMER 

S8  JAMMER 

2/2 

2 

JTIOS  LB 

NIS  LB 

LB  JAMMER 

LB  JAMMER 

2/1 

3 

(  MIDS  ) 

SINT  AC  3  <  +  >  LB 

(  NIS  ) 

LB  JAMMER 

1/1 

LB-L  BANO  SB-S  BAND 


Fig.  1 4(a)  Cost/efficiency  of  the  various  one  and  two  band  system  versus  jammers 


-  THE  WIDE  BAND  ASYNCHRONOUS  ANO  SYNCHRONOUS  CHANNEL  RECEIVERS  CAN  BE  EXCHANGED 

-  TEXT  RECEIVERS  CAN  BE  EXCHANGED 


-  THE  H.F.  STAGES  ONLY  ARE  SPECIFIC  THE  S  AND  L  BANDS 


-  THIS  TERMINAL  PERFORMS  ALL  THE  COMMUNICATION,  NAVIGATION  BROADCAST  AND  Q  AND  R 
IDENTIFICATION  FUNCTION  IN  THE  L  AND  S  BANOS  IN  ACCORDANCE  WITH  CHANNEL  ORGANIZATION 
ANO  SAFETY  REQUIRED 


Fig.  1 5  S  and  L  band  terminal  block  diagram 


UHF 


Fig.  1 6  Communication  types  in  accordance  with  the  carrier 


SINT  AC 


Fig.  1 7  Terminal  configurations 
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GOOD  PERFORMANCES  (COMPATIBLE) 

BAD  PERFORMANCES  (INCOMPATIBLE) 

SOME  DEGRADATION  IN  PERFORMANCES 

NOT  IN  USE  AT  THE  SAME  TIME  OR  FOR  THIS  FUNCTION 


Compatibility  between  all  L  band  systems 
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INTEGRATED  NAVIGATION-TF/TA-SYSTEM 
BASED  ON 

STORED  TERRAIN  DATA  PROCESSING 
by 

Dipl.-Ing.  Horst-Dieter  Lerche 
Vereinigte  Flugtechnische  Werke  GmbH 
2800  Bremen  1 
Hiinefeldstra&e  1-5 

Germany 


SUMMARY 


This  paper  is  a  contribution  to  the  solution  of  the  problem,  how  terrain-following- 
flight  can  be  made  more  reliable  and  optimal  in  the  sense  of  smoothing  against  the 
terrain.  The  main  source  of  information  in  the  discussed  system  is  a  terrain  data 
base  aboard  the  aircraft,  in  which  the  height  values  of  the  overflown  area  are 
stored  coherently.  A  system  description  will  be  given  including  the  monitoring 
function.  A  hardware  -  and  software  design  of  the  combined  navigation  -  and  tf/ta- 
flight  control  system  is  developed,  adapted  to  a  modern  avionic-system-architecture. 

1 .  Introduction 


The  tremendous  progress  in  microprocessor  technology  and  digital  data  processing 
have  caused  a  trend  towards  such  highly  sophisticated  avionic  system  with 
decentralized  system-architecture . 

This  trend  has  resulted  from  the  progress  made  in  microprocessor-technology  and 
in  development  of  new  mass-memory-devices.  In  this  context  one  could  remember 
the  availability  of  high  speed  single-chip-microprocessors  and  highly  integrated 
bubble-memory-circuits  for  application  in  digital  avionic  systems. 

Classical  real-time  solution  to  problems  involving  complex  mathematical  relation¬ 
ships  can  be  performed  by  parallel  computation  and  parallel  processing  in  a 
microprocessor  system  with  decentralized  architecture. 

In  modern  military  aircraft  there  is  an  increasing  tendency  of  achieving  the 
capability,  to  fly  in  very  low  heights  during  adverse  weather  conditions  and  in 
any  electromagnetic  environment.  If  an  aircraft  remains  low  at  near  sonic  speed 
above  all  occurlng  types  of  terrain,  it  is  difficult  to  be  detected  and  very 
difficult  to  hit. 

With  decreasing  heights  there  is  a  reduced  vulnerability  risk  due  to  hostile 
defence  systems,  but  an  increasing  risk  of  collision,  especially  under  adverse 
weather  conditions  in  a  mountainous  area. 

To  fly  as  low  as  possible  at  near  sonic  speed  above  occuring  types  of  terrain 
means  that  the  terrain  profile  in  front  of  the  aircraft  must  be  known  very 
accurate. 

An  automatic  control  is  done  in  state-of-the-art-system  by  computing  on  optimal 
flight  path  from  terrain-following-radar-measurement.  But  there  are  inherent 
physical  limitations. 
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By  aiding  this  terrain-following-radar  with  a  terrain  data  base  aboard  the 
avionic-system  the  false-alarm-rate  may  be  decreased. 
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2.  TERPAC-System 

The  system,  which  offers  this  characteristic  ,  is  called  TERPAC.  TERPAC  is  an 
abbreviation  of  TERRAIN-PARAMETER-COMPARSION  (fig.  1).  The  comparison  is  done  in  the 
position-fix-mode  by  matching  the  measured  terrain-signatures  against  terrain- 
reference-signatures  stored  in  the  terrain  mass-memory.  In  the  case  of  terrain-profile- 
correlation  (PROKOR)  the  actual  position  of  the  aircraft  is  computed  by  matching 
the  scanned  terrain-signals  with  digitized  terrain  values,  stored  in  the  TERPAC-mass- 
memory.  In  the  case  of  scene-correlation  (SZEKOR)  the  comparison  is  performed 
between  an  actual  image  of  the  terrain-contour  taken  with  an  image-making  sensor 
and  a  stored  reference  image. 

Whether  the  position-f ix-system  operates  in  a  single-fix  -  or  in  a  continuons  mode 
depends  on  the  significance  of  the  overflown  terrain  and  on  the  functional  status. 

If  failure  is  indicated,  the  system  will  be  resynchronized  by  switching  over  from 
the  continous-mode  to  the  single-fix  de. 

On  the  other  hand  the  terrain-follov.  ,ig-system  will  be  provided  with  the  stored  terrain 
data  in  the  fourth  mode  in  order  to  optimize  the  reference  flight-path  against  the 
actual  flight-path  by  means  of  software.  The  critical  point  on  the  terrain  ahead  of 
the  vehicle,  predicted  by  the  TERPAC-System, and  the  optimal  flight-path  are  computed. 

The  optimal  flight-path  is  as  close  to  all  stored  terrain-grid-points  as  practical 
for  controlling  the  minimum  clearance  above  the  terrain. 

In  fig.  1  the  main  characteristics  of  the  TERPAC-System  have  been  highlighted: 

-  automatic,  because  the  processing  is  automatically  performed  in  the  preplanned 
mission  "waypoint-computation 

-  autonomous ,  because  the  system  is  independent  upon  external  stations  and  data- 
iinks  like  GPS  or  other  classical  radio  navigation  system 

the  further  advantages 

-  all  weather-,  night  capability,  high  anti  1am  resistance,  low  detectibility 
correspond  to  the  behaviour  of  the  downlooking  radar-altimeter-sensor. 

In  order  to  extract  the  terrain-profile  ahead,  the  position  of  the  aircraft  must  be 
known  very  accurate  with  respect  to  the  terrain  in  front  of  it. 

In  the  TERPAC-System  both  the  position  and  the  predicted  terrain-following-profile 
are  calculated  in  a  common  terrain-pre-processing  stage. 

Fig.  2  shows  the  principle  of  terrain-data-management  within  three  tf/ta  cycles  n, 
n  +  1,  n  +  2.  Corresponding  to  the  travelling  progress  the  numbers  characterize 
the  terrain-frames,  which  will  be  processed  by  the  tf/ta-subsystem  in  a  predective 
manner  and  by  the  correlation-subsystem  in  a  recursive  manner. 

The  tf/ta-frame  n,  generated  from  the  terrain  mass  memory  around  a  predicted  position, 


'V 
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will  be  matched  by  the  correlation  system  two  cycles  later.  The  typical  frame-length 
will  be  determined  according  to  the  overflown  type  of  terrain. 

The  block-diagram  in  fig.  3  shows  the  principle  data  flow  and  the  control  functions 
of  the  TERPAC-system. 

The  terrain-map-mass-memory  and  the  digitized  terrain-data  stored  in  it  serve  as 
the  basic  data-source  both  for  the  position-f ixing-system  and  for  the  terrain-follow¬ 
ing/  avoidance-system.  In  addition  the  digitized  terrain-data  may  be  pre-processed 
for  projection  on  a  digital-map-display  instead  of  an  analogous  device  or  for 
obstacle  warning  to  the  pilot. 

The  TERPAC-processor  as  a  central  processing  unit  computes  in  a  recursive  manner 
the  actual  position  by  correlation-algorithms  and  in  a  predicting  manner  the 
reference  flight-path  by  optimizing  algorithms. 

The  differential  output  signals  generated  in  the  tracker  software  module  by 
comparison  of  the  predicted  reference  flight  path  with  the  actual  flight  path  are 
fed  to  the  flight  control  system. 

Switching  over  from  one  mode  of  operation  and  the  inherent  sensor  subsystem  to 
another  will  be  controlled  prior  to  data  pre-processing. 
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The  position-fixing-subsysteme  consists  of: 

-  inertial  measurement  unit 

-  radar  altimeter  subsystem 

-  data  pre-processing  modul 

-  TERPAC-processor 

-  terrain-mass-memory 

-  kalman-filter 

Fig.  A  shows  the  principal  data-flow  of  the  combined  navigation  and  correlation-system. 
The  overflown  contour  is  calculated  from  the  differential  output  signal  of  baro-sensor 
and  the  platform  vertical  channel  and  from  the  radar  altimeter  outputs.  The  actual 
position  of  the  vehicle  corresponds  to  the  correlation-maximum,  computed  in  the 
terpac-unit. 

Not  only  the  difference  between  the  indicated  and  the  actual  position  is  processed 
in  the  kalman-filter,  but  the  difference  between  the  predicted  height  above  ground 
and  the  actual  radar  altimeter  reading. 

By  estimating  the  errors  of  the  inertial  unit  and  feeding  back  it  to  the  navigation 
computation,  the  behaviour  of  the  aided  navigation  system  will  be  improved.  The 
dynamic  models  of  the  inertial-system  and  of  radar  altimeter-  and  positions-fix- 
measurement  are  implemented  in  the  kalman-filter. . 

3 .  Posit  ion- fix-mode 


The  values  of  clearance  altitude  and  the  altitude  obove  datum-plane,  continuously 
measured  by  the  radar  altimeter  and  the  baro  aided  vertical  channel  of  the  intertial 
measurement  unit  (fig,  5),  are  simultaneously  stored  in  a  pre-processing  stage.  After 
pre-processing  (noise-filtering,  data  reduction,  time  synchronisation)  the  measured 
terrain  profile  is  generated  as  differential  signal  and  fed  to  the  TERPAC-correlator 
stage . 

This  processing  method  guarantees  that  the  motion  of  the  vehicle  in  the  vertical 
plane  is  eliminated,  ensuring  that  additional  terrain  elevations  cannot  be  simulated. 
These  additional  terrain-elevations  could  reduce  the  resulting  position-fix  accuracy 
of  the  TERPAC-aided  intertial  navigation  system. 

The  additive  interfering  noise  signals  will  degrade  the  signal  to  noise  ratio  and 
thereby  increase  the  false-fix-probability . 

Comprehensive  filtering  methods  are  necessary  both  for  correlation  and  terrain 
following  computation  to  reduce  this  influence.  The  result  of  such  signal  processing 
is  shown  in  fig,  6. 

The  terrain  profile  as  a  difference-signal  between  barometric  and  radar-altimeter- 
measurement  is  derived  from  raw-data  of  flight  experiments. 

The  problem  of  terrain-noise-reduction  is  that  of  extremely  low-pass-filtering. 
Because  the  whole  terrain-information  is  contained  in  low  spatial  frequencies, 
compared  to  higher  frequencies  of  additive  terrain-noise. 

Furthermore  this  error-behaviour  will  be  modelled  in  the  kalman-filter-algorithms. 

The  filtered  terrain  profile  in  the  middle  of  fig.  6  is  a  good  aproxmation  of  the 
profile  at  the  bottom,  generated  from  topographical  map  of  1:50.000  scale.  The  low 
pass  filter  will  be  designed  with  an  adaptive  corner-frequency,  adapted  to  the 
spatial  domain  spectrum  and  the  velocity  of  the  aircraft. 

Besides  the  motion  in  the  elevation-plane  the  aircraft  will  be  operated  by  the  pilot 
in  the  horizontal  plane.  In  contrast  to  a  preplanned  mission  with  preplanned  flight- 
path  in  missile-guidance,  the  TERPAC-system  must  guarantee  maximum  flexibility  and 
will  be  subordinated  to  the  basic  navigation  system. 

To  operate  during  horizontal  maneuvers  and  variable  flight-paths  is  the  key  to 
TERP AC- posit ion- fix-mode. 

The  principle  of  navigation  update  consists  of  correlation  performance  with  a  so 
called  flight-template,  generated  from  the  measured  inertial  position-values  within 
the  update  area. 
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Representing  the  height-values  on  a  geographic-grid,  the  digital  map  of  the  update- 
area  will  be  preprocessed  from  the  terrain  data  stored  in  the  terrain-mass-memory. 

It  will  be  constructed  around  a  principle  track,  predicted  from  the  last  coarse- 
informations. 

The  size  of  the  update  area  will  be  adapted  automatically  to  the  time-dependent 
error-behaviour  of  the  inertial  measurement  unit  and  the  travelling  time  between 
two  update  areas. 

By  this  means  it  is  guaranteed,  that  the  indicated  flight-template  doesn't  lie  out 
of  the  update  area. 

The  correlation  process  is  initiated  after  crossing  the  waypoint.  The  flight  template 
is  displaced  along  and  across  the  flight  direction  until  the  best  fit  occurs. 

The  position  of  the  correlation  maximum  corresponds  to  the  actual  position  of  the 
aircraft. 

After  each  desplacement  the  height  values  under  the  flight-template  will  be  extracted 
from  the  terrain-data-base  and  put  together  to  a  new  virtual  correlation  track. 

Position  fixes  are  calculated  in  the  continous-mode  within  overlapping  update  areas. 
The  size  of  the  update-area  varies  because  of  decreasing  position  uncertainty.  Like 
a  sliding  correlation-window  the  update  area  follows  the  flight-path. 

The  position-fix-system  operates  in  two  modes.  If  a  failure  occurs  or  the  radar-alti¬ 
meter  is  out  of  track,  the  system  will  be  resynchronized  in  a  single-fix-mode.  In 
this  case  the  update  area  is  expanded. 

A .  Ter rain- following/a voidancr -continuous  mode 

The  main  components  of  the  tf/ta-subsystem  (fig.  7)  are: 

-  tf-controller 

-  terrain-mass-raemory 

-  radar-altimeter 

-  failure-logic 

-  tf-,  mapping-radar 

-  tf/ta-,  mapping-display 

In  the  well  known  ski-type-algorithm  only  information  about  the  terrain  in  the 
present  line-of-sight  of  the  terrain-following-radar  is  used.  In  contrast  to  it, 
the  tf-controller  takes  full  advantage  of  the  stored  map  by  using  the  over-the-hill 
data.  The  result  is  an  optimal  fit  to  the  terrain  with  better  descenting  into 
valleys  instead  of  flight-path-angle  control. 

In  developing  the  terrain  data  aided  terrain-following-system,  great  emphasis  must 
be  put  on  finding  a  safe,  reliable  and  confident  failure  logic.  To  achieve  this, 
the  control-loops  have  to  be  redundant  together  with  sophisticated  data  checks. 

If  a  failure  occurs  in  the  tf-radar-system,  the  logic  decides,  whether  the  radar- 
system  will  be  aided  on  the  level  of  distance  -  or  angle  measurement. 

In  the  case  of  total  disturbance  the  tf-controller  calculates  continously  the 
distance  to  the  nearest  obstacle  in  front  of  the  aircraft  by  using  the  stored  terrain 
data  and  the  radar-altimeter-signals. 

The  radar-altimeter  is  a  back-up  sensor  in  the  tf-system.  It  provides  altitude- 
information,  which  is  transformed  into  a  command-signal,  when  no  returns  from  the 
forward-looking-radar  are  available  and  the  terrain-data  are  not  reliable. 

On  the  other  hand  a  pull-up-command  is  initiated,  when  the  actual  height  is  below 
the  selected  clearance  height. 

In  the  manual  or  automatic  tf/ta-flight-control-system  it  is  important,  to  indicate 
the  upcoming  terrain-situation  to  the  pilot  via  display.  The  examples  in  the 
following  figures  demonstrate,  that  the  synthetic  terrain-characteristics  can  be 
generated  from  the  stored  terrain-data-base. 
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The  pilot  monitors  the  correct  function  of  the  system  and  its  reponse  to  terrain 
ahead,  observing  the  E-Scope  during  terrain-following-control  (fig.  8)  The  terrain 
heights  including  the  secure  flight-path  are  displayed  against  the  distance  in 
logarithmic  scale.  Indicating  valleys  out  of  the  line  of  sight  is  an  advantage 
of  this  synthetic  display. 

The  horizontal  plane-display  in  fig,  9  is  a  good  tool  for  manual  or  automatic  ta- 
control. 

Corresponding  to  the  aircraft-altitude  avoidance-regions  will  be  calculated.  The 
advantage  in  this  case  is,  that  the  hidden-lines  behind  the  hills  are  presented. 
Selecting  the  avoidance-regiones  the  ta-control-f 1 ight  will  be  performed  by  the 
pilot . 

The  synthetic  Gray-Scale-Display  in  fig.  10  offers  the  possibility  of  manual  or 
automatic  tf/ta-control .  A  perspective  of  the  ter ‘ain  ahead  is  simulated  by  gray¬ 
scales  decreasing  with  distance. 

Furthermore  additional  symbols  for  command,  flight-path,  position  and  altitude 
of  the  aircraft  are  shown.  In  fig.  11  the  advantages  of  a  navigation  tf/ta-flight 
control-system  based  on  stored  terrain-data  are  summarized: 

-  The  system  operates  either  in  a  back-up-mode  by  time  synchronuous  aiding  the 
tf-radar-system  or  in  a  stand-alone-mode  during  operational  phases  of  silence 
in  a  hostile  jamming  environment. 

-  Also  reliable  recognition  of  obstacles  is  guaranteed  in  the  case,  when  radar- 
returns  are  not  available. 

The  results  of  optimal  flight  path  approximation  against  terrain  are: 

-  reduced  maximum  g-loads 

-  soft-ride  commands 

A  possible  hardware-  and  software-design  of  the  combined  navigation-  and  tf/ta-f light- 
control-system,  adapted  to  a  modern  avionic-system-architecture,  is  shown  in  fig.  12. 

The  key  elements  of  this  architecture  are: 

-  hierarchilly  structured  bus-system 

-  decentralized,  autonomous  microprocessor  modules 

The  signals  coming  from  flight-computer,  the  radar-altimeter  and  the  terrain-following- 
radar  are  transmitted  into  the  terpac-subsystem  via  the  avionic  bus. 

The  terrain-processor  controls  the  data-transroission  in  both  directions  and  provides 
the  tf/ta-  and  navigations-subsystem  with  the  preprocessed  terrain-data.  If  the 
data-channel-capacity  is  not  sufficient,  the  data  will  be  transmitted  via  an  inter¬ 
face-unit  IFU. 

For  monitoring  the  terrain-datas  on  a  multi-function-display  or  a  head-up-display, 
the  preprocessed  terrain  data  will  be  transmitted  via  direct  memory  access  to  the 
display-management-stage. 

A  ground  based  data-management  is  needed,  to  transfer  the  terrain  data  from  the 
terrain  data  base  to  the  terrain-mass-memory  aboard  the  aircraft.  Two  methods  can 
be  distingnished : 

! 

At  first  the  terrain  data  base  of  a  whole  area  of  about  150.000  km  is  permanently 
stored  in  the  terrain  mass  memory.  In  this  case  only  the  flight-computer  must  be 
programmed  by  inserting  the  waypoint-coordinates  before  a  mission. 


In  the  other  case  the  digital  terrain  data  are  preprocessed  during  the  mission¬ 
planning-phase  and  transferred  together  with  other  information  into  the  terrain 
mass  memory  of  the  aircraft  via  a  datalink. 
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METHOD 


TERPAC  -processor  matches  measured  terrain-signatures  against  terrain-reference-signatures 
stored  in  the  mass  memory  and  compares  TF/TA-f  light  path  with  stored  terrain  data 


MODES  OF  OPERATION 


inertial  mode 


0  position-fix-mode  (single,  continuous)  -PROKOR- 
#  SZEKOR-position-fix-mode 
0  terrain-following/avoidance-continuous  -mode 

CHARACTERISTICS 


autonomous 


all-weather-,  night  capability 

high  anti-jam  resistance,  low  detectibility 


TERPAC  (T££RAIN  -  PARAMETER  -  COMPARISON) 


l/FW 


PRINCIPLE  OF  TERRAIN  DATA  PROCESSING 


l/^W 
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GRAY-SCALE  DISPLAY  FOR  TF/TA-CONTROL 


I few 


Fig.10 


ADVANTAGES 

• 

back-up-mode  of  TF-redar-system  (shadowing) 

• 

stand-alone  mode  during  operational  phases  of  silence 

• 

reliable  recognition  of  obstacles 

• 

reduced  maximum  g-louds 

• 

soft  ride  commands 

• 

reduced  detectability  and  ECM-vulnerability 

• 

optimal  flight-path-approximation  against  terrain  (valleys) 

TF/TA-FLIGHT-CONTROL-SYSTEM 
BASED  ON  STORED  TERRAIN  DATA 
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LA  NAVIGATION  OPTIMALE  INERTIE-CORRELATION  D' ALTITUDE 
UNE  SOLUTION  ATTRATANTE  AU  PROBLEMS  DE  LA  NAVIGATION  POUR  AVION  D*  ATTAQUE  AU  SOL 


par 

L.  Cafflberlein,  M.  de  Cremiers,  D.  Chermette 
SAGEM 

6,  avenue  d'lena 
75783  Paris 
France 

(presente  au  33eme  symposium  du  GCP  AGARD  en  octobre  198 1  a  Athenes) 

RESUME 


Cet  expose  coneerne  1 ' appl ication  du  reealage  de  l'inertie  par  correlation 
d'altitude  aux  avions  de  penetration  et  d'attaque  au  sol  tout  temps.  II  est  base  sur 
une  etude  en  cours,  sur  contrat  du  gouvernement  frangais.  II  rappelle  brievement  les 
principes  du  positionnement  par  correlation  d'altitude.  II  analyse  les  parametres 
influant  sur  la  precision  du  point.  Pour  1 'application  sur  avion  d'attaque  au  sol,  des 
algorithmes  speciaux  omnidirectionnels  ont  ete  conqus  pour  permettre  une  grande  liberte 
en  cap  au-dessus  de  la  zone  de  reealage.  L' expose  resume  ensuite  les  principales  earac- 
teristiques  d' utilisation,  interessantes  pour  l'avion  de  penetration  et  d’attaque  au 
sol  tout  temps  :  reealage  en  3  dimensions,  precision  elevee,  autonomie,  discretion, 
insensibilite  au  brouillage,  automaticite,  faibles  contraintes  de  pilotage  et ,  dans  le 
cas  du  reealage  omnidir ectionnel ,  souplesse  de  definition  et  de  modification  de  la 
mission.  II  rappelle  egalement  brievement  le  principe  et  les  avantages  du  reealage 
optimal  de  l'inertie  par  filtrage  de  KALMAN,  a  partir  de  la  correlation  d'altitude.  Les 
ameliorations  qui  en  decoulent  pour  la  position  et  la  Vitesse  peuvent  etre  essentielles 
pour  un  suivi  de  terrain  precis  et  pour  la  mise  en  oeuvre  des  armes ,  1 ' initial isat ion 
et  l'alignement  en  vol  de  missiles  tactiques. 

II  montre  la  possibilite  et  1'interet,  technique  et  economique,  de  pouvoir  integrer 
dans  l'unite  inertielle  les  traitements  de  l'inertie  pure,  de  la  correlation,  du  fil¬ 
trage  optimal  et  meme  de  l’attaque  air/sol.  II  decrit  le  scenario  de  mise  en  oeuvre 
d'une  telle  solution  au  cours  d'une  mission  d'attaque  au  sol  tout  temps.  II  presente 
d'abord  la  preparation  de  la  mission  avec  selection  des  terrains  immediatement  avant 
vol  ou  apartir  d'un  fichier  de  terrains  prepares  a  l'avance  et  couvrant  tout  un  thea¬ 
tre  d'operation.  II  montre  1'interet  de  l'emploi  sur  l'avion  d'une  memoire  a  cassette, 
de  type  a  bulles  magnetiques  par  exemple.  II  presente  ensuite  le  deroulement  de  la 
mission  proprement  dite  et  la  souplesse  de  modification  possible. 


OPTIMAL  INERTIAL  NAVIGATION  USING  TERRAIN  CORRELATION 
AN  ATTRACTIVE  SOLUTION  TO  THE  GROUND  ATTACK  AIRCRAFT  NAVIGATION  PROBLEM 


SUMMARY 


The  subject  of  thi3  paper  is  the  use  of  terrain  correlation  for  all  weather  pene¬ 
tration  and  ground  attack  aircraft.  It  is  based  on  a  contract  from  the  French  govern¬ 
ment.  Positioning  by  terrain  correlation  is  briefly  reviewed.  For  the  ground-attack- 
aircraft  application  special  algorithms  allow  large  heading  freedom  over  the  updating 
area.  The  parameter  sensitivity  of  the  updating  accuracy  is  analysed.  This  includes  the 
terrain  characteristics  (and  hence  the  extensive  terrain  selection  procedure  required), 
tne  cartography  accuracy  and  the  altitude  measurement  accuracy.  The  main  operational 
features  for  ground  attack  aircraft  are  summarized  :  tri-dimensional  updating  ;  high 
accuracy  facilitated  by  low  altitude  flight  ;  self-contained,  secure,  jam-resistant, 
automated  operation  ;  a  low  level  of  heading  constraint  to  and  over  the  updating  area  ; 
savings  in  weight,  volume,  electrical  power  and  cost  using  sensors  already  needed  on 
the  aircraft  (i.e.  INS,  and  radio  and  barometric  altimeters)  ;  moderate  level  of 
sophistication  and  hence  reliability.  The  only  specific  need  is  a  cassette  memory  of 
intermediate  size.  The  principle  of  inertial  system  optimal  updating  is  also  briefly 
discussed.  Temporal  carryover  from  position  and  velocity  updates  can  be  crucial  for 
accurate  horizontal  terrain  following  and  weapon  delivery  initialization  and  in-flight 
alignment  of  tactical  missiles.  The  possibility  and  the  technical  and  economical  inte¬ 
rest  of  integrating  correlation  and  optimal  filtering  in  the  inertial  unit  are  shown.  A 
typical  all  weather  ground  attack  mission  scenario  is  described.  This  includes  the 
extensive  mission  preparation,  the  nominal  flight  plan  and  possible  alternatives, 
update  area  selection  using  ground  based  equipment  and  map  data  bases,  and  the  data 
assembly  and  c?3sette  loading.  Mission  preparation  can  be  eased  and  shortened  by  using 
files  of  adequate  update  areas  which  have  been  preselected  and  cover  all  the  theater  of 
operation  and  by  using  ma33  memory  in  the  aircraft  (such  as  magnetic  bubble  memory) . 

The  mission  execution  itself  includes  the  nominal  flight  plan  execution,  the  automatic 
update  warning,  execution  and  control,  possible  flight  plan  mod i f icat ion ,  or  even  an 
update  of  opportunity.  A  possible  operational  system  architecture  is  described  with  the 
necessary  equipment. 
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1 .  INTRODUCTION 


Le  recalage  de  I'inertie  par  correlation  d’altitude  eat  connu  dans  son  utilisa¬ 
tion  sur  les  missiles  de  croisiere  americains.  Cet  expose  concerne  son  application  aux 
avions  de  penetration  et  d'attaque  au  sol  tout  temps. 

La  necessite  de  pouvoir  realiser  des  missions  de  penetration  et  d'attaque  au  sol 
tout  temps  en  territoire  hostile  s'impose  de  plus  en  plus  aux  etats-ma jors .  Le  perfec- 
tionnement  des  moyens  de  defense  aerienne  et  de  guerre  electronique  exige  pour  la 
survie  que  cette  penetration  se  fasse  en  suivi  de  terrain  a  l'altitude  la  plus  bas3e 
possible  et  a  la  Vitesse  la  plus  elevee  possible,  et  qu'elle  soit  precise,  autonome  et 
discrete.  Enfin,  la  mise  en  oeuvre  des  armes  sur  l'objectif  doit  egalement  etre 
precise . 

Ce  type  de  mission  est  done  tres  exigeant  car  il  aecumule  les  difficultes  de  la 
survie  aux  defenses  aeriennes  ennemies  et  de  la  securite  du  vol  en  suivi  de  terrain 
tout^ temps.  Depuis  quelques  annees,  les  progres  techniques  permettent  de  realiser  des 
systemes  qui  repondent  plus  ou  moins  bien  a  chacun  de  ces  besoins.  Les  avions  utilises 
sont  au  moins  bi-places,  a  cause  de  la  chargede  travail.  Ils  sont  generalement  bi- 
reacteurs.  La  quantite  d ' electronique  embarquee  est  grande.  Tel  est  le  cas  des  avions 
de  penetration  tout  temps  Fill,  TORNADO. 

Pour  la  prochaine  generation,  compte  tenu  des  progres  techniques  et  technolo- 
giques,  les  etat-majors  souhaitent  pouvoir  utiliser  des  avions  de  taille  et  de  eout 
plus  moderes,  e'est-a-dire  des  monoplaces,  monoreacteurs .  Ceci  suppose  une  reduction  de 
la  charge  de  travail,  done  une  automaticite  plus  grande,  ainsi  qu'un  volume  d'electro- 
nique  plus  faiDle.  Ils  souhaitent  aussi  des  progres  en  discretion,  car  la  survie  est 
essentielle,  mais  aussi  en  fiabilite  et  en  precision  de  navigation. 

L'objet  de  cet  expose  est  de  montre'r  qu'un  systeme  integre  de  navigation  optimale 
inertie-correlation  d'altitude  pourrait  etre  un  element  de  reponse  a  ces  objectifs 
ambitieux,  en  ce  qui  concerne  la  discretion ,  la  precision .  1 ' autonomie ,  la  soupl esse  et 
1 'automaticite  de  la  mise  en  oeuvre,  la  fiabilite  et  1 ' economie  de  materiel. 

Cet  expose  s'appuie  sur  un  contrat  du  Service  Technique  des  Telecommunications  et 
des  Equiperaents  Aeronautiques  (STTE)  du  gouvernement  franqais  dont  l’objet  est  l'etude 
et  1' experimentation  en  vol  d'un  tel  systeme  pour  avion  de  penetration  et  d'attaque  au 
sol  tout  temps. 


2.  PRINCIPE  DE  POSITIONNEHENT  PAR  CORRELATION  D’ALTITUDE 


2.1  Generalites  (Voir  planche  N°  1) 


Le  princjpe  du  positionnement  par  correlation  d’altitude  consiste  a  relever  sur 
quelques  kilometres  le  profil  de  l'altitude  du  terrain  survole  et  son  orientation  dans 
le  plan  geographique ,  puis  a  rechercher  le  profil  correspondent  sur  une  carte  d'alti¬ 
tude  de  la  zone  concernee.  La  carte  est  stockee  sous  forme  numerique  dans  une  memoire 
embarquee.  Si  le  profil  releve  etait  sans  erreur,  il  co'inciderait  exactement  avec  celui 
de  la  carte  en  memoire,  a  condition  que  la  position  indiquee  par  I'inertie  soit  egale¬ 
ment  sans  erreur.  En  realite,  l'erreur  de  I'inertie  n'etant  pas  nulle,  pour  trouver  un 
profil  identique  au  profil  releve,  il  est  necessaire  de  faire  une  certaine  translation 
dan3  le  plan  horizontal.  Cette  translation  que  l'on  peut  mesurer  correspond  evidemment 
a  l'erreur  de  position  de  I'inertie  et  le  profil  identifie  en  memoire  donne  la  position 
vraie . 


En  pratique,  la  carte  d'altitude  de  la  zone  survolee  est  disponible  en  memoire 
point  par  point,  selon  un  maillage  regulier  caracterise  par  la  taille  de  sa  ''cellule" 
elementaire,  voir  figure  1.  L'altitude  du  terrain  survole  est  calculee  par  difference 
entre  l'altitude  "absolue"  baro-inertiel le ,  fournie  par  I'inertie,  et  l'altitude  rela¬ 
tive  de  1' avion  par  rapport  au  terrainj  fournie  par  la  radio-sonde,  voir  figures  2et 

3.  L'altitude  du  terrain  survole  est  memorisee  au  fur  et  a  mesure  sous  forme  de  points 
regul ierement  e3pace3.  A  chaque  point  sont  associes  les  coordonnees  horizontales 
donnees  par  I'inertie.  La  recherche  du  profil  identique  de  la  carte  en  memoire  est 
reali3ee  par  calcul  du  degre  de  coincidence,  ou  de  "correlation",  du  profil  releve  avec 
tous  les  profils  paralleles  de  la  carte,  obtenus  par  des  translations  successives  dans 
le3  deux  dimensions.  A  chaque  translation,  le  calcul  fait  correspondre  une  valeur  de 
correlation.  A  l'ensemble  correspond  une  surface  de  correlation.  La  recherche  du  maxi¬ 
mum  de  cette  surface  fournit  les  deux  composantes  de  la  position  vraie.  Comme  on  le 
verra  au  paragraphe  6.2,  il  est  possible  de  determiner  une  indication  du  degre  de 
confiance  de  cette  position  "vraie",  tres  utile  pour  le  recalage  optimal  de  I'inertie. 
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Figure  1  :  PRINCIPE  DU  POSITIDNNEMENT 
PAR  CORRtLATION  D'AITITUDE 


2.2  Correlation  d* altitude  oanidirectlonnelle 


Dans  le  cas  d'une  trajectoire  preprogrammee ,  la  zone  de  reoalage  peut  etre  rec- 
tangulaire  et  orientee  selon  la  route  desiree  prevue  au  depart.  Son  survc’  est  realise 
en  ligne  droite.  Sa  largeur  correspond  a  l'erreur  de  navigation  maximale  possible,  qui 
depend  de  l'inertie  et  du  temps  ecoule  depuis  le  precedent  recalage.  La  longueur  est  au 
minimum  egale  a  la  longueur  de  correlation  necessaire  pour  determiner,  sans  ambiguite, 
le  profil  de  la  carte  identique  a  celui  releve,  voir  paragraphe  4.1. 

Cette  definition  de  la  zone  de  recalage  peut  convenir  aux  missions  de  penetration 
entierement  preprograramees ,  dont  la  preparation  est  realisee  a  l’avance  dans  le 
detail.  Cependant,  sur  un  avion  pilote,  il  peut  etre  souhaitable  de  disposer  de  plus  de 
liberte  dans  le  choix  de  l'axe  d'approche  de  la  zone  ou  dans  les  evolutions  possibles 
sur  la  zone.  Ceci  peut  etre  souhaitable  par  exemple,  pour  permettre  en  vol  la  modifica¬ 
tion  de  la  mission  face  a  des  circonstances  imprevues,  ou  la  prise  en  compte  d'objec- 
tifs  d'opportunite,  et  pour  simplifier  au  sol  la  preparation  de  la  mission. 

Un  algorithme  a  ete  specialement  developpe  pour  repondre  a  ces  besoins.  II  auto¬ 
rise  le  survol  de  la  zone  a  une  route  quelconque  et  selon  des  evolutions  importantes. 

La  zone  memorisee  est  alors  earree  comme  le  montre  la  figure  4.  La  surface  a  memoriser 
et  done  le  volume  memoire  necessaire  augmentent  dans  ce  cas  d'un  facteur  de  l'ordre  de 
2,3  ce  qui  ne  pose  pas  de  difficulty  particuliere  avec  les  dernieres  technologies  de 
memoires . 


3.  PRINCIPALES  CARACTBRISTIQUES  DU  RECALAGE  PAR  CORRELATION  D'ALTITUDE 


Le  recalage  par  correlation  d'altitude  presente  un  certain  nombre  de  particulari- 
tes  interessantes .  Tout  d'abord,  il  permet  un  recalage  de  la  position  dans  les  3  dimen¬ 
sions  ■  En  effet,  en  plus  du  positionnement  precis  dans  le  plan  horizontal .connaissant 
l'altitude  du  terrain  survole,  on  peut  reconstituer  l'altitude  de  survol  de  l'avion,  a 
partir  de  la  hauteur  radio-sonde.  La  precision  du  recalage  de  l'altitude  est  celle  de 
la  radio-sonde  a  l'altitude  de  survol,  entachee  de  l'erreur  de  eartographie  au  point 
considere,  Un  autre  aspect  interessant  concerne  1 ' autonomie  du  recalage.  Aucun  equipe- 
ment  exterieur  a  l'avion  n'est  necessaire  :  toutes  les  informations  necessaires  au 
recalage,  y  compris  la  carte  du  terrain  survole,  sont  contenues  dans  l'avion.  Sur  le 
plan  de  la  discretion,  la  radio-sonde  est  consideree  comme  d i f f icilement  detectable  a 
partir  du  sol,  en  raison  de  3a  faible  portee  dans  le  plan  horizontal  (emission  dirigee 
vers  le  bas).  Il  en  resulte  aussi  une  grande  insensibility  au  brouillage,  de  meme  pour 
le  baro-altimetre  etla  centrale  inertielle. 

Sur  le  plan  operationnel ,  on  peut  mettre  en  evidence  un  certain  nombre  de  quali- 
tes  particulieres  :  simplicity  de  fonctionnement ,  grande  liberte  de  survol  du  terrain 
et  facilite  de  mise  en  oeuvre.  Le  fonctionnement  du  recalage  en  vol  ne  necessite  aucun 
mode  particulier  de  la  part  de  l'inertie,  du  baro-altimetre,  de  la  radio-sonde,  ni  des 
autres  equipements  avion.  La  securite  de  la  mission  et  du  vol  basse  altitude  en  suivi 
de  terrain  est  renforcee.  Le  mode  de  recalage  par  correlation  d'altitude  peut  done  etre 
mis  en  oeuvre  dans  toutes  les  phases  de  la  mission.  Le  survol  du  terrain  selectionne 
pour  ie  recalage  ne  necessite  pas  de  contraintes  particulieres  de  pilotage,  ni  en  cap 
d'entree  sur  la  zone,  ni  en  tenue  d'altitude,  ni  en  evolution .  Une  grande  liberte  de 
manoeuvre  peut  ainsi  etre  laissee  au  pilote.  La  mise  en  oeuvre  est  relativement 
simple  :  en  vol,  le  fonctionnement  est  entierement  automatique  et  la  preparation  du  vol 
se  resume  au  choix  des  zones  de  recalage  (voir  paragraphe  6.1).  Enfin,  la  precision  du 
recalage  est  excel lente  :  70  m_ CEP  en  utilisant  une  carte  numerisee  au  pas  de  100  m  et 
potentiellement  mieux  encore  des  qu'une  numerisation  plus  fine  des  cartes  le  permet- 
tra.  Cette  precision  est  obtenue  dans  le  cas  de  missions  a  tres  basse  altitude.  Dans 
les  autres  cas,  la  precision  va  en  diminuant  quand  l'altitude  augmente. 

Enfin,  la  banque  de  donnees  utilisee  pour  la  preparation  de  la  mission  est 
relativement  simple  puisqu'elle  consiste  en  cartes  memorisees  d'altitude.  Elle  ne 
necessite  pas  de  traitements  particuliers  en  fonction  du  cap  ni  de  l'altitude 
d ' approche.  11  n'y  a  pratiquement  pas  de  probleme  de  mise  a  .jour,  car  la  correlation 
d'altitude  utilise  de3  caracteriques  globables  du  terrain  qui  sont  permanentes  et  non 
des  [joints  remarquables ,  tels  que  des  constructions,  qui  peuvent  evoluer  ou  etre 
v  ulnerables . 

En  resume,  cette  technique  de  recalage  offre  un  grand  nombre  d'avantages  par 
rapport  aux  autres  moyens  de  recalage  possibles  et  s'avere  particulierement  bien  adap- 
tee  aux  avion3  d'armes  modernes,  pour  les  missions  de  penetration  tres  basse  altitude 
et  d'attaque  au  sol  tout  temps. 


4 .  PARAHETRES  INFLUANT  SUR  LA  PRECISION  DU  POINT 

Les  parametres  qui  interviennent  dans  la  precision  du  point  peuvent  etre  ratta- 
che3  aux  principaux  elements  suivants  : 


le  terrain, 

le  releve  d'altitude  en  vol, 
la  carte  d'altitude  en  memoire. 


Figure  2  :  CALCUL  OE  L'ALTITUDE  DU  TERRAIN  PAR  DIFFERENCE  ENTRE  L'ALTITUDE 
"ABSOLUE"  INERTIE  BARO  ET  L'ALTITUDE  RADIO  AITIMETRE 


Figure  3  :  SCHEMA  FONCTIONNEl  DU  POSITIONNEMENT 
PAR  CORRELATION  O'ALTITUDE 
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4.1  Le  terrain 

En  premiere  analyse  ce  sont  les  caracteristiques  spectrales  (spatiales)  des  mou- 
vements  du  terrain  qui  comptent.  Pour  que  la  precision  du  point  soit  inferieure  ou 
egale  a  une  cellule,  qualitativement  : 

-  l'amplitude  des  mouvements  du  terrain  doit  etre  significative,  c'est  a  dire 
nettement  superieure  a  la  precision  et  a  la  resolution  du  releve  (radio-sonde 
et  inertie)  et  a  celles  de  la  carte  en  memoire, 

-  la  longueur  L  du  profil  a  correler  doit  etre  nettement  superieure  aux  longueurs 
d'onde  X  des  mouvements  significatifs  du  terrain, 

-  les  longueurs  d'onde  X  des  mouvements  significatifs  du  terrain  doivent  etre 
nettement  superieures  a  deux  fois  la  taille  de  la  cellule  (theoreme  de 
Shannon) . 


En  resume,  il  est  necessaire  que 


L  »  X  »  2  cellules 

Pour  eviter  les  faux  recalages,  c'est  a  dire  ceux  dont  la  precision  est  supe¬ 
rieure  a  une  cellule,  il  faut  egalement  que  le  terrain  ne  contienne  pas  de  profils 
identiques  distants  de  plus  d'une  cellule. 

Une  selection  complete  du  terrain  est  done  essentielle  pour  garantir  les  perfor¬ 
mances  du  calcul  du  point  par  correlation  d'altitude.  Cette  selection  necessite  des 
traitements  numeriques  et  doit  etre  realisee  a  l'aide  d'un  systeme  informatique  adapte, 
voir  paragraphe  7 . 

Cette  premiere  analyse  a  ecarte  un  certain  nombre  d'aspects  du  terrain  tels  que 
nature  de  sol,  vegetation,  constructions,  qui  sont  analyses  au  paragraphe  4.2  par  leurs 
effets  sur  l'erreur  du  radio-altimetre. 

4.2  Le  releve  d'altitude  en  vol 

La  precision  du  releve  d'altitude  depend  dans  le  plan  vertical  de  celles  du 
radio-altimetre  et  du  filtrage  inert ie-baro.  Dans  le  plan  horizontal  elle  depend  de  la 
precision  de  1' inertie. 

.  Radio-altimetre 

En  theorie  le  radio-altimetre  mesure  la  distance  la  plus  courte  dans  le  champ  de 
l'antenne  entre  l'avion  et  le  sol,  mais  en  pratique  il  integre  grossierement  la  surface 
couverte  par  son  lobe.  Une  dimension  de  cellule  inferieure  a  la  surface  au  sol  couverte 
par  le  lobe  du  radio-altimetre  est  done  inutil isable .  La  precision  d'un  radio-altimetre 
est  3chematiquement  fonction  de  la  nature  du  sol  survole,  de  l'altitude,  de  l'attitude 
avion,  de  l'ouverture  d'antenne  et  de  la  Vitesse  avion.  Le  vol  a  tres  basse  altitude 
est  favorable  a  une  bonne  precision.  Le  raodele  du  radio-altimetre  est  represente  gene- 
ralement  par  une  erreur  de  facteur  d'echelle,  supposee  constante  dans  le  temps  et  seu- 
lement  dependante  de  la  nature  du  terrain  survole. 

.  Filtrage  inertie-baro 

Un  filtrage  inertie-baro  delivre  l'equivalent  d'une  altitude  absolue,  decalee  de 
l'erreur  baroraetrique  a  long  terme.  Son  excellente  resolution,  son  excellente  precision 
a  court  terme  et  sa  bande  passante  elevee,  par  rapport  a  la  dynamique  avion,  sont 
l'apport  de  1 ' accelerometre  vertical  de  l'inertie.  Ces  caracteristiques  remarquables 
sont  tre3  utile3  pour  mesurer  de  fagon  precise  les  variations  instantanees  d'altitude 
de  l'avion  en  3uivi  de  terrain.  En  pratique  les  erreurs  instantanees  d'un  filtrage 
inertie-baro  performant  sont  negligeables  pour  la  correlation  d'altitude,  de  meme  que 
son  erreur  a  long  terme. 

.  Inertie 

L'inertie  fournit  la  position  estimee  du  profil  et  sa  restitution  dans  le  plan 
horizontal.  L’erreur  de  restitution  est  une  erreur  de  mesure  supplementaire  pour  la 
correlation.  Elle  depend  de  l'erreur  de  Vitesse  geographique  et  de  la  duree  T  du  releve 
correle,  ou  encore  de  la  Vitesse  vectorielle  relative  et  de  la  longueur  L  du  profil 
correle  : 

M|  |«v| 

Erreur  de  restitution  =  1 5 V  I  T  =  —  .  L  =  —  .  N.C. 

V  V 

ou  N  est  la  longueur  correlee,  exprimee  en  nombre  de  cellules. 


J 
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C  est  Xa  dimension  d'une  cellule. 

Pour  garantir  une  erreur  de  restitution  inferieure  a  une  cellule,  il  faut 
verifier  que  : 


—  V 

MV  |  _ 

N 

Pour  N  =  50  par  exemple  et  une  vitesse  de  400  noeuds,  la  precision  de  la  Vitesse 
Nord  et  Est  doit  etre  meilleure  que  4  m/s,  c'est  a  dire  de  l'ordre  de  4  m/s  a  2  ou  3  . 
Une  telle  precision  correspond  a  un  systeme  inertiel  de  bonne  performance,  c'est  a  dire 
de  la  classe  1NM/H  CEP  et  1  m/s  a  1  . 


4.3  La  carte  d’altitude  en  memoire 


Les  caracteristiques  importantes  de  la  carte  d'altitude  en  memoire  sont  la  preci¬ 
sion  de  l'altitude  au  point  considere  et  la  dimension  de  la  cellule. 


.  Precision  de  la  carte  d'altitude 


Er.  pratique  la  carte  est  realisee,  soit  a  partir  de  cartes  a  grande  echelle  exis- 
tantes,  soit  par  photogrammetrie  a  partir  de  photographies  aeriennes  ou  satellites.  On 
peut  noter  que  1' utilisation  fait  surtout  intervenir  les  altitudes  di f f erent ielles ,  ce 
qui  est  favorable,  et  qu'une  precision  superieure  a  celle  du  releve  en  vol  est  inutile. 


.  Dimension  de  la  cellule 


La  taille  de  la  cellule  conditionne  di^ectement  la  resolution  du  point  done  sa 
precision.  La  precision  theorique  possible  est  d'environ  0,7  fois  la  dimension  de  la 
cellule.  Compte-tenu  de  la  resolution  descartes  actuellement  disponible  et  de  celle  de 
la  radio-sonde,  une  cellule  de  50  a  100  metres  est,  aujourd'hui,  la  mieux  adaptee  au 
recalage  precis  a  tres  basse  altitude. 


5.  NAVIGATION  OPTIHALE  INERTIE-CORRELATION  D'ALTITUDE 
5.1  Principe 


L ' ut i 1 isat ion  la  plus  efficace  de  1' information  donnee  par  la  correlation  d'alti¬ 
tude  consiste  a  realiser  une  hybridation  par  filtrage  de  Kalman  avec  l'inertie.  Les 
erreurs  de  position  dans  les  trois  dimensions,  fournies  par  la  correlation,  sont  trai- 
tees  comme  des  observations  de  l'erreur  de  position  de  l'inertie.  Le  filtre  en  deduit 
une  estimation  "optimale"  des  erreurs  inertielles.  Cette  estimation  est  utilisee  pour 
recaler  l'inertie. 

L'efficacite  et  les  performances  de  cette  hybridation  sont  interessantes  a  cause 
de  la  possibility  de  definir  un  assez  bon  modele  des  erreurs  de  l'inertie,  des  carac¬ 
teristiques  tres  basse  frequence  de  l'evolution  de  ces  erreurs,  et  de  la  grande  preci¬ 
sion  des  points  de  correlation  d'altitude,  raeme  si  la  frequence  de  ces  points  est 
relativement  faible. 

La  figure  5  montre  un  exemple  de  performances  simulees.  Elle  indique,  pour  une 
mission  de  penetration  type,  l'evolution  de  precision  de  position  et  de  vitesse,  au  fur 
et  a  mesure  de  quatre  recalages  par  correlation  d'altitude,  de  70  m  CEP  de  precision, 
espaces  de  10  minutes,  et  dans  le  cas  d'une  inertie  de  la  classe  1  NM/H  CEP.  L'aroelio- 
ration  de  la  precision  de  la  position,  mais  aussi  de  la  vitesse,  obtenue  par  la  naviga¬ 
tion  optimale  inertie-correlation  d'altitude  est  un  element  important  pour  la  realisa¬ 
tion  precise  tout  temps  de  la  penetration,  de  la  mise  en  oeuvre  des  armes  convention- 
nelles  ainsi  que  de  1' initialisation  et  de  l'alignement  des  missiles  tactiques. 


5.2  Integration  dans  le  systeme  inertiel 


Le3  fonctions  : 

-  navigation  inertie  pure  dans  le  plan  horizontal, 

-  inertie-baro  dans  le  plan  vertical, 

-  correlation  d'altitude, 

-  filtrage  de  Kalman, 

sont  tres  dependantes  les  unes  des  autres.  Elies  echangent  beaucoup  d ' informat  ions 
entre  elles,  mais  globalement  peu  avec  l'exterieur.  Certains  de  ces  echanges  sont 
bouoles  ;  ils  sont  generalement  assortis  de  contraintes  temps  reel  assez  severes  liees 
a  la  dynamique  avion  d'arme3. 
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II  est  done  naturel  que  les  traitements  correspondants  soient  realises  dans  le 
meme  ealculateur,  sans  oublier  que  les  charges  de  ealcul  et  les  volumes  memoires  sont 
relativement  signi ficat i fs . 

Or  la  definition  moderne  des  fonctions  et  des  performances  d'un  systeme  de  navi¬ 
gation  inertiel  pour  avion  d'armes  demande  dans  le  '■ysteme  un  ealculateur  assez  puis¬ 
sant,  a  cause  de  la  complexite  des  traitements  necessaires.  La  technologie  electronique 
disponible  permet  de  couvrir  largement  ces  besoins,  sans  penaliser  le  volume  du  sys¬ 
teme. 

Ainsi  1' unite  inertielle  mul t i- fonct ions  du  systeme  ULISL  possede  un  micro- 
calculateur  rapide,  de  la  classe  *400.000  operations  par  seconde,  en  une  seule  carte,  et 
une  capacite  memoire  de  64.000  mots  de  16  bits.  Cette  unite  inertielle  est  compacte 
puisque  son  volume  est  inferieure  a  16  litres  et  son  poids  inferieur  a  16  kilogrammes, 
voir  figure  6.  La  charge  de  calcul  et  le  volume  memoire  disponibles  permettent  d'y 
integrer  sans  difficulte  la  correlation  d'altitude  et  le  filtrage  de  Kalman. 

D'autres  integrations  fonct ionnel les  ont  deja  ete  realisees  dans  le  systeme 
ULISS,  telles  que  navigation  inertielle,  ealeuls  aerodynamiques ,  gestion  de  bus  mul'.l- 
plexe  1  Megabit,  ainsi  que  l’attaque  air/sol,  bombe,  canon,  roquette,  missile.  Cet' e 
derniere  fonction  est  egalement  tres  liee  aux  informations  inertielles  de  position, 
vitesse  et  attitude  pour  les  calculs  de  balistique,  de  presentation  et  d 1  acquisition 
dans  le  viseur,  de  pointage  radar  ou  telemetre.  Compte  tenu  des  progres  electroniques , 
il  est  raisonable  de  dire  que,  dans  peu  d'annees,  il  sera  possible  d’integrer  dans  un 
systeme  type  ULISS  l'ensemble  de  ces  fonctions  plus  la  correlation  d'altitude  et  le 
filtrage  de  Kalman,  comme  le  suggere  la  figure  7.  Une  telle  integration  pourrait  etre 
une  bonne  solution  pour  les  futurs  avions  d'attaque  au  sol  tout  temps,  tant  sur  le  plan 
operationnel  que  sur  le  plan  de  l'economie  de  materiel. 


6.  DESCRIPTION  DE  LA  MISE  EN  OEUVRE  OPERATIONNELLE 


Ce  paragraphe  decrit  de  faqon  fonctionnelle  la  raise  en  oeuvre  du  recalage  de  la 
navigation  par  correlation  d'altitude  pour  une  mission-type  d'avion  de  penetration  ou 
d’attaque  au  sol  tout  temps. 


6.1  Preparation  de  la  mission 


La  mission-type  d'un  avion  de  penetration  peut  etre  definie  de  la  fapon  suivante: 
enchainement  de  plusieurs  segments  de  navigation  (16  par  exemple) ,  chacun  de  ces 
segments  etant  defini  par  le  but  a  atteindre  en  fin  de  segment  (voir  figure  8).  On  peut 
envisager  un  objectif  principal  (but  n°  18),  un  objectif  secondaire  (but  n°  15')  avec 
choix  de  l'objectif  apres  le  7eme  segment.  Il  faut  envisager  aussi  un  deroutement  pos¬ 
sible  apres  le  lOeme  segment  par  exemple  et  retour  vers  le  but  n°  14".  On  pourrait 
imaginer  un  plus  grand  nombre  de  trajectoires  possibles  pour  une  meme  mission  princi- 
pale,  avec  un  plus  grand  nombre  de  deroutements  possibles  par  exemple. 

A  partir  du  plan  de  vol  ainsi  defini,  il  s'agit  de  definir  les  zones  de  recalage 
le  long  des  trajectoires  possibles  de  penetration,  en  respectant  un  intervalle  de  temps 
determine  (7  a  12  mn  par  exemple)  entre  les  recalages  et  en  choisissant  le  dernier 
point  de  recalage  le  plus  pres  possible  de  l'objectif  a  atteindre  (but  n'  15  ou  15'). 

Un  nombre  typique  de  zones  de  recalage  est  de  4  pour  une  trajectoire  :  zones  (1)  a  (4) 
pour  la  mission  principale,  zones  (1),  (5),  (6),  (7)  pour  la  mission  secondaire  et  zone 
(8)  pour  le  deroutement  possible.  L'ordre  de  grandeur  de  8  zones  de  recalage  pour  une 
mission-type  est  donne  purement  a  titre  indicatif.  Pour  assurer  une  grande  securite  de 
navigation  et  obtenir  une  bonne  performance  de  recalage,  il  est  necessaire  d'effectuer 
le  meilleur  choix  possible  de  ces  zones  de  recalage.  La  liberte  de  choix  est  possible 
le  long  de  chaque  segment  de  navigation.  Les  criteres  de  choix  sont  essentiellement  : 
relief  suffisant,  vegetation  non  genante  (forets  par  exemple),  pas  de  construct ions^ 
importantes  (villages,  viaducs,  chateaux  d'eau,  etc  ...).  L ' appl icat ion  de  ces  criteres 
de  choix  montre  qu'il  ne  presente  pas  de  contrainte  particuliere  pour  des  operations  en 
turope  par  exemple.  Cette  affirmation  a  ete  confirmee  au  cours  de  vols  experimentaux 
sur  le  territoire  franpais. 

La  precision  et  la  "fiabilite"  du  recalage  dependant  directement  de  la  qualite  de 
.  t  selection  du  terrain,  en  pratiquej  les  operations  de  selection  de  la  zone  de  reca- 
.  if  consistent  a  analyser  les  parametres  statistiques  du  terrain  ainsi  que  l'lmpossi- 
■  ..’A  de  rencontrer  de  faux  recalages.  Ces  operations  necessitent  un  traitement  infor- 

t-  .  4  ie  elabore,  realise  sur  un  systeme  de  preparation  au  sol. 

:  am  :e  qui  precede,  la  selection  de  terrain  a  ete  supposee  faite  dans  le  cadre 
i  ; reparation  de  la  mission  juste  avant  le  vol.  Cependant,  la  preparation  de  mis- 
, r r a i *  etre  allegee  par  1 ' ut i 1 isat ion  d'un  fichier  de  zones  de  recalage  convena- 

,•■•4  a  1'avance  et  couvrant  l'equivalent  de  plusieurs  missions  (5  a  10  par 
.  ie  tout  un  theatre  d'operations  (100  a  200  zones  pour  1.000  km2  par 

•  fi  mer  pourrait  etre  prepare  a  1'avance  et  stocke  dans  une  cassette,  sup- 
.  <  .<*1  jperations  de  selection  immediates  avant-vol.  Les  technologies 

,  )„  developpement  permettent  de  satisfaire  ces  besoins  sans  difficulte 
le  faible  encorabreraent . 
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6.2  Mise  en  oeuvre  du  recalage 


.  Operations  avant  survol  de  la  zone 


La  selection  du  mode  de  recalage  par  correlation  d'altitude  peut  se  faire  des  le 
depart  de  la  mission.  En  effet,  le  declenchement  du  processus  de  recalage  est  realise 
de  faqon  automatique  en  fonction  du  rapprochement  de  l'avion  vers  la  zone  de  recalage. 
L ' enchainement  des  buts  de  navigation,  selectionne  manuellement  ou  automatiquement , 
permet  de  prevoir  s'il  y  aura  ou  non  passage  sur  une  zone  de  recalage  et  de  lancer  ou 
nonla  preparation  automatique  du  processus,  en  partieulier  le _ chargement  du  terrain 
numerise  en  memoire  de  travail.  Cette  preparation  est  declenchee  sur  le  resultat  d'un 
test  de  la  distance  avion-zone  de  recalage. 


.  Presentation  et  survol  de  la  zone 


La  zone  de  recalage  est  identifiee  par  un  point  de  reference  qui  constitue  le 
point  de  passage  souhaite  sur  le  terrain.  La  presentation  de  l'avion  sur  la  zone  est 
visualisee  au  pilote  sur  l'indicateur  tete  haute.  Au  cours  du  survol  de  la  zone,  aucune 
contrainte  particuliere  de  pilotage  n'est  necessaire.  Le  pilote  dispose  d ' une  indica¬ 
tion  presente  tant  que  l'avion  survole  la  zone,  lui  signalant  que  le  processus  de 
recalage  est  en  cours. 


.  Validation  du  recalage 


Une  foisles  calculs  de  correlation  effectues^  les  resultats  de  recalage  sont 
visualises  en  ecarts  de  position  sur  l'indicateur  tete  basse  ou  tete  haute.  En  plus 
des  ecarts  de  position,  l'algorithme  de  correlation  fournit  un  indice  de  qualite  du 
recalage  qui  a  l'une  des  3  significations  suivantes  : 

-  bon  recalage  (inferieur  a  1  cellule), 

-  recalage  moins  precis,  mais  suffisant  pour  recaler  la  navigation  (inferieur  a  2 
ou  3  cellules  par  exemple) , 


-  faux  recalage  important  tres  probable. 

On  peut  automatiser  la  prise  en  compte  de  1' indice  de  qualite  en  acceptant  le 
recalage  dans  le  ler  casket  en  le  refusant  dans  le  3eme,  la  decision  de  recaler  incom- 
oant  au  pilote  dans  le  2eme  cas.  On  pourrait  alleger  totalement  la  charge  du  pilote  et 
rendre  entierement  automatique  la  prise  en  compte  du  recalage  (par  exemple  en  refusant 
le  recalage  dans  le  2eme  cas). 


7.  INTEGRATION  DANS  LE  SYSTEME  DE  NAVIGATION  ET  D'ARMES 


7 . 1  Configuration  proposee 


La  figure  9  presente  une  configuration  possible  pour  avion  de  penetration  et 
d'attaque  au  sol  tout  temps  a  1 ' horizon  85-90 .  Les  prinoipaux  equipements  sont  connec¬ 
ted  a  un  bus  multiplexe  redondant.  Les  equipements  en  soute  comprennent  : 

-  un  radio-altimetre  numerique, 

-  2  jeux  de  capteurs  anemometriques, 

-  un  ensemble  inertiel  redondant  constitue  de  2  systemes  inertiels  multi-fonc- 
tions. 

Chaque  sy3teme  inertiel  multi- fonct ions  integre  a  l'inertie  les  fonctions  : 

-  calcul3  anemometriques, 

-  filtrage  inertie-baro  , 

-  correlation  d'altitude, 

-  filtrage  de  Kalman, 

-  attaque  Air/Sol, 

-  gestion  bus. 
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Les  equipements  en  cockpit  comprennent  : 

-  un  viseur  tete  haute, 

-  un  viseur  tete  basse, 

-  une  memoire  a  cassette. 

Cette  configuration  montre  sur  le  plan  materiel  les  avantages  suivants  : 

a)  Aucun  equipement  sophistique  supplementaire  n'est  necessaire  mis  a  part  la 
memoire  a  cassette  qui  peut  servir  a  bien  d'autres  besoins  :  plan  de  vol , 
armement ,  maintenance,  etc  . 

b)  La  possibility  de  realiser  une  integration  fonctionnelle  elevee  avec 
1' inertie. 

c)  Un  bilan  reduit  de  volume,  masse,  consommation  electrique,  partieulierement 
interessant  dans  le  cas  d'un  mono-reacteur . 

d)  Une  configuration  relativement  simple,  done  fiable. 

7.2  Caracteristiques  des  equipements  pour  la  correlation 


Ce  paragraphe  presente  les  caracteristiques  importantes  des  equipements  neces- 
saires  a  1 ' utilisation  operationnel le  de  la  correlation  d’altitude. 


.  Radio-altimetre 


Les  principales  caracteristiques  du  radio-altimetre  sont  la  precision  de  la  mesu- 
re  de  hauteur,  la  sensibilite  a  la  nature  du  terrain  et  l'ouverture  du  diagramme  d'an- 
tenne.  La  precision  de  quelques  pour-cents  des  radio-altimetres  moderne3  est  suffi- 
sante.  Certains  radio-altimetres  parmi  les  plus  recents,  tel  que  le  modele  numerique 
AHV-12  de  TRT ,  donneraient  merae  une  precision  de  1  f  quelle  que  soit  la  nature  du 
terrain.  Cette  reduction  de  sensibilite  a  la  nature  du  terrain  est  un  element  important 
qui  peut  contribuer  a  elargir  les  criteres  de  selection  de  terrain. 


.  Altitude  barometrique 


L'altitude  barometrique  est  utilisee  par  l'inertie  pour  elaborer  l'altitude  de 
reference  de  l'avion,  appelee  altitude  baro-inertielle .  Les  performances  absolues 
d'altitude  barometrique  ne  sont  pas  critiques  pour  la  correlation  d'altitude  car  son 
erreur  est  typiquement  un  biais,  non  genant  puisque  la  grandeur  a  mesurer  est  le  profil 
du  terrain  survole  et  non  son  altitude  absolue.  La  stabilite  a  court  t erne  du  biais 
d'altitude  baro  n'est  pas  genante  non  plus  puisque  les  variations  d'altitude  de  l'avion 
sont  raesurees  par  1 ' accelerometre  inertiel. 


.  Viseurs  tete  haute  et  tete  basae 


II  s'agit  de  presenter  au  pilote  une  figuration  lui  permettant  de  le  renseigner 
sur  la  position  de  l'avion  par  rapport  a  la  zone  de  recalage,  de  voir  le  resultat  de  la 
correlation  et ,  si  necessaire  d'intervenir  sur  la  validation  du  recalage.  Dans  le  cas 
de  l'avion  monoplace,  il  est  peut  etre  preferable  d'avoir  une  validation  automatique, 
avec  une  indication  simple  du  recalage  accepte  ou  refuse. 


.  Memoire  a  cassettes 


Le  volume  memoire  necessaire  correspond  au  nombre  maximal  de  zones  de  recalage 
prevu  gour  une  mission.  En  se  refer ant  a  la  mission-type  decrite  au  paragraphe  6.1,  il 
faut  memorl3er  au  moins  une  dizaine  de  zones.  En  considerant  un  besoin  de  3  K  mots  de 
16  bits,  soit  48  K  bits  par  zone  omnidirectlonnelle,  le  besoin  de  memoire  est  evalue  a 
0,5  H  bits  environ  par  mission.  Des  memoires  a  bulles  magnetiques  utilisees  sous  forme 
de  petite3  cassettes  de  16  M  bits  sont  en  cours  de  developpement .  Leur  capacite 
permettrait  de  contenir  l'equivalent  de  plusieurs  missions  ou  meme  de  tout  un  theatre 
d ' operat ions  ,  (10  M  bits  pour  200  zones). 


.  Sy st erne  a  inertie 


Les  caracteristiques  necessaires  pour  une  correlation  precise  d'altitude  ont  ete 
abordees  au  paragraphe  4.2  et  correspondent  a  la  classe  de  performance  1  NM/h  et  1  ro/s. 


8. 


INSTALLATION  POUR  LA  PREPARATION  DE  MISSION 


La  preparation  de  ia  mission  est  realisee  au  sol  avec  une  installation  particu- 
liere.  A  partir  du  plan  de  vol,  il  3'agit  de  selectionner  les  zones  de  recalage  a  pre- 
voir  au  oours  du  vol  et  de  charger  la  cassette  avion  avec  les  terrains  choisis.  Cette 
installation  dispose  d'une  bibliotheque  de  cartes  numerisees  avec  la  resolution  maxima¬ 
le  disponible  (aujourd'hui  3"  d'arc). 

On  peut  concevoir  une  installation  independante  pour  la  selection  de  terrain  ou 
realisant  la  preparation  complete  de  la  mission. 

La  configuration  de  1* installation  proposee  est  repre3entee  sur  la  figure  n*  10. 
Les  traiteoents  necessaires  sont  realises  par  un  mini-calculateur ,  de  type  indu3triel 
par  exemple.  Des  per ipheriques  relativement  simples  completent  1' installation.  Par  ail- 
leurs,  1' installation  est  prevue  pour  etre  raccordee  a  un  reseau  numerique  militaire. 

L ' installation  doit  permettre  de  realiser  en  temps  reel  la  selection  des  terrains 
et  leur  chargement  en  cassettes  avec  un  temps  de  reaction  court.  Enfin,  1 'exploitation 
de  cette  installation  est  etudiee  pour  etre  utilisee  de  fapon  simple  par  un  operateur 
non  specialise,  par  exemple  avec  un  dialogue  en  langage  conversationnel . 


9 .  CONCLUSION 


L'expose  a  raontre  les  caracteristiques  remarquables  de  la  navigation  optimale 
inertie-correlation  d'altitude  : 


-  sur  le  plan  operationnel ,  la  precision  de  la  position  et  de  la  vitesse  dans  les 
trois  dimensions,  la  discretion,  la  resistance  au  brouillage,  l'autonomie,  la 
grande  liberte  de  pilotage  autorisee  et  le  fonctionnement  automatique,  qui  sont 
necessaires  pour  la  3urvie  et  pour  l'efficaeite, 

-  sur  le  plan  materiel,  la  possibilite  et  l'interet  d'une  integration  fonction- 
nelle  elevee  dans  l'inertie,  et  1' utilisation  d' equipements  simples  indispensa- 
bles  par  ailleurs  a_l  'avion,  qui  conduisent  a  une  solution  fiable  et  economique 
en  volume,  masse,  cablage  et  puissance, 


-  sur  le  plan  de  la  preparation  de  la  mission,  une  complexite  moderee  qui  peut 
etre  encore  reduite  par  1 ' util isat ion  d'une  memoire  de  masse  sous  forme  d’une 
petite  cassette  en  cours  de  developperaent . 

Ces  caracteristiques  remarquables  font  de  la  navigation  optimale  inertie-correla¬ 
tion  d'altitude  une  solution  attrayante  pour  les  avions  de  penetration  et  d'attaque  au 
30l  tout  temps  de  la  generation  85-90. 
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Summary 

The  Integrated  Flight  and  Fire  Control  (IFFC)  program  is  a 
USAF  Advanced  Development  Program  to  design,  build,  test,  and 
evaluate  an  improved  weapon  delivery  system.  This  improvement 
is  accomplished  by  an  automatic  coupler  and  modified  flight 
control  system  to  steer  out  tracking  errors  calculated  by  a 
director  fire  control  system  using  information  from  an  ATLIS  II 
electro-optical  tracker.  The  F-15B  aircraft  is  the  test  bed 
aircraft. 

Simulation  and  analysis  results  indicate  that  the  IFFC 
system  has  excellent  air-to-air  gunnery  accuracy  with  decreased 
pilot  workload.  These  results  also  indicate  that  attacker 
survivability  in  air-to-ground  gunnery  and  bombing  encounters 
can  be  increased  by  using  maneuvering  approaches  without 
compromising  air-to-ground  weapon  delivery  accuracy. 

Extensive  ground  testing  of  IFFC  hardware  and  software  has 
taken  place  and  is  described  herein.  The  IFFC  system  is 
currently  being  evaluated  in  a  15  month  flight  test  program 
which  began  in  June  1981.  Early  testing  has  centered  around 
verifying  proper  system  operation.  Details  of  the  flight  test 
program  plan  are  presented  in  this  paper. 


1.  Introduction 

The  USAF  is  sponsoring  a  program  to  design,  build,  test  and  evaluate  an  Integrated 
Flight  and  Fire  Control  (IFFC)  system  on  an  F-15B  fighter  aircraft.  IFFC  involves  the 
blending  of  pilot  control  with  automatic  control  to  achieve  improved  weapon  delivery 
accuracy  and  survivability  in  air-to-air  gunnery,  air-to-ground  gunnery,  and  bombing. 
Automatic  control  is  achieved  by  generating  command  signals  to  the  flight  control  system 
based  on  steering  errors  determined  by  the  fire  control  system.  Figure  1  compares  weapon 
line  control  for  the  baseline  F-15B  and  the  F-15B  with  the  IFFC  system. 


F-1  SB  BASELINE 


F  158  WITH  IFFC  SYSTEM 
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The  overall  IFFC  program  consists  of  two  contracted  efforts:  IFFC  I,  being  performed 
by  McDonnell  Aircraft  (MCAIR)  and  sponsored  by  the  Plight  Dynamics  Lab  ( AFWAL/FIGX ) ;  and 
FIREFLY  III,  being  performed  by  General  Electric  (GE) ,  Aircraft  Equipment  Division,  and 
sponsored  by  the  Avionics  Lab  (AFWAL/AART) .  The  IFFC  I  program  is:  (1)  providing  the 
coupling  between  the  flight  and  fire  control  systems,  (2)  modifying  the  standard  F-15 
control  augmentation  system  (CAS)  to  accept  coupler  command  inputs  and  to  tailor  flight 
control  response  for  weapon  delivery,  and  (3)  integrating  the  overall  system.  The  FIREFLY 
III  program  is:  (1)  providing  an  electro-optical  sensor/tracker  pod  (ATLIS  II), 
(2)  processing  tracking  data  to  generate  target  state  information,  and  (3)  using  target 
data  to  implement  a  director  fire  control  system.  The  FIREFLY  III  program  is  discussed  in 
detail  in  Reference  (1). 

The  primary  objective  of  the  overall  IFFC  program  is  to  demonstrate  the  feasibility 
of  improving  weapon  delivery  accuracy  and  attacker  survivability  through  the  use  of  IFFC 
techniques.  This  paper  presents  an  overview  of  the  IFFC  program  including  system 
description,  tracking/flight  control  features,  safety  provisions,  system  operational 
description,  the  onboard  simulation  feature,  predicted  weapon  delivery  performance,  and 
test  and  evaluation  plans. 

2.  IFFC  System  Description 

A  block  diagram  of  the  F-15B/IFFC  system  equipment  and  their  interfaces  with  existing 
F-15  equipment  is  presented  in  Figure  2.  Three  existing  line  replaceable  units  (LRUs)  are 
modified  and  six  new  ones  are  added. 
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Figure  2.  F-15B  Equipment  and  Information  Flow 


Coupler  Interface  Unit  (CIU)  -  The  CIU  is  the  heart  of  the  IFFC  system.  It  consists 
of  a  central  processor,  a  32K  memory,  a  MIL-STD-1553A  multiplex  bus  terminal,  and 
analog-to-digital  (A/D),  digital-to-analog  (D/A),  and  discrete  input/output  circuitry. 
The  MIL-STD-1553A  multiplex  bus  conveys  digital  information  to  and  from  the  CIU,  the  F-15 
central  computer  (CC),  the  sensor/tracker,  and  the  IFFC  airborne  test  instrumentation 
system.  The  D/A  and  A/D  circuitry  transmits  data  to  and  receives  data  from  the  CAS  and 
aircraft  control  surfaces.  The  discrete  input/output  circuitry  receives  mode  and  control 
signals  from  aircraft  systems  and  control  panels.  It  transmits  these  status  signals  for 
display  to  the  pilot. 

The  CIU  contains  both  FIREFLY  III  and  IFFC  I  software.  The  FIREFLY  III  software 
consists  of  modules  for  the  Kalman  filter  target  state  estimation,  the  director  fire 
control  system,  the  bombing  system,  the  ATLIS  II  tracking  loop  rate  aiding,  the  coordinate 
transformations,  the  attacker  aircraft  state  estimation,  and  the  sensor  preprocessors. 
The  IFFC  I  software  consists  of  modules  for  the  gunnery  and  bombing  coupler  control  laws, 
the  Inflight  Integrity  Management  (IFIM)  system,  the  Built  in  Test  (BIT),  and  the  Onboard 
Simulation  (OBS)  modes. 


F-15  Central 

Computer 

(CC) 

-  The  CC  communicates  with  the  existing  F-15  subsystems 

the  existing 

multiplex 

DUS. 

It  has  been  modified  to  communicate  with  the  new  IFFC 

subsystems  over  the  added  MIL-STD-1553A  multiplex  bus.  The  modified  CC  acts  as  the  1553A 
bus  controller.  Also,  the  Controls  and  Displays  module  of  the  CC  has  been  modified  to 


accept  Head  Op  Display  (HUD)  symbology  information  from  the  CIU.  It  combines  this  infor¬ 
mation  with  existing  F-15  HUD  symbology  and  transmits  the  combined  data  to  the  modified 
HUD  Signal  Data  Processor. 

F-15B  Control  Augmentation  System  (CAS)  -  The  CAS  has  been  modified  to  provide  flight 
control  responses  tailored  for  thi  weapon  delivery  tasks  and  to  accept  command  signals 
from  the  CIU.  Details  of  the  CAS  modification  are  presented  in  Section  3. 

ATLIS  II  Sensor/Tracker  -  ATLIS  II  is  an  electro-optical  imaging  tracker  with  laser 
ranging  capability.  It  is  carried  in  a  pod  approximately  8  feet  long,  12  inches  in 
diameter  and  weighing  320  pounds.  This  pod  will  be  carried  on  the  left  forward  sparrow 
missile  station.  The  ATLIS  II  has  an  area  correlation  tracking  mode  as  well  as  several 
contrast  tracking  modes.  Its  line-of-sight  can  be  controlled  by  the  pilot  or  slaved  to 
the  radar  or  INS  for  initial  target  acquisition.  Following  lockon,  the  ATLIS  II  tracker 
will  be  rate  aided  using  attacker  aircraft  and  target  state  information  from  the  CIU. 

Controls  and  Displays  -  The  F-15B/IFFC  forward  crew  station  is  shown  in  Figure  3. 
The  primary  IFFC  controls  are  the  IFFC  Control  Panel,  the  F-15B/IFFC  Throttle,  the 
F-15B/IFFC  Stick  Grip,  the  FIREFLy  III  Control  Panel,  and  the  Navigation  Control  Indicator 
(NCI).  The  primary  IFFC  displays  are  the  Vertical  Situation  Display  (VSD)  and  the  Head  Up 
Display  (HUD). 


IFFC  Control  Panel  -  The  IFFC  control  panel,  Figure  4,  serves  as  the  central  control 
and  status  display  panel.  It  has  hardwired  connections  with  the  CIU,  the  CAS  and  the  CC. 
The  master  power  switch  controls  power  to  the  IFFC  Control  Panel  and  CIU.  The  IFFC  ON/OFF 
switch  assigns  some  of  the  throttle  and  stick  switch  functions,  and  changes  HUD  and  VSD 
displays  alternately  to  IFFC  (ON)  and  normal  F-15  (OFF).  It  does  not  engage  the  IFFC 
coupler  and,  hence,  sends  no  commands  to  the  flight  control  system. 

The  weapon  mode  lights  identify  which  IFFC  weapon  delivery  mode  the  pilot  has 
selected.  The  velocity  switch  provides  information  to  the  modified  CAS  for  use  in 
converting  acceleration  limits  to  pitch  rate  limits.  The  simulation  switch  is  used  to 
enable  the  Onboard  Simulation  (OBS)  mode  which  includes  display  of  a  simulated  target  on 
the  HUD.  The  Initial  Operating  Condition  (IOC)  light  illuminates  when  an  IOC  for  the  OBS 
target  run  has  been  selected;  the  RUN  light  illuminates  when  the  simulated  target  sequence 
is  in  progress.  The  configuration  select  button  is  used  to  transfer  configuration 
parameter  data,  which  the  pilot  has  entered  into  the  CC  using  the  NCI,  from  the  CC  to  the 
CIU. 


The  BIT  button  initiates  the  IFFC  Built-in-Test.  It  flashes  while  the  test  is  in 
progress,  remains  on  if  a  failure  is  detected,  and  extinguishes  if  no  failure  is  detected. 
The  IFFC  warning  light  illuminates  when  a  failure  of  any  IFFC  I  element  has  been  detected 
which  would  prevent  coupling  of  the  flight  and  fire  control  systems.  The  POD  warning 
light  illuminates  when  a  failure  has  been  detected  in  the  FF  III  sensor/  tracker  pod. 

Throttle  and  Stick  Control  Functions  -  The  F-15B/IFFC  throttle  functions  are  shown  in 
Figure  5.  Only  the  functions  of  the  secondary  control  buttons  are  changed  from  the  F-15B. 
They  ace  controlled  by  the  ON/OFF  switch  on  the  IFFC  Control  Panel.  The  only  F-15B  stick 
grip  switch  function  that  changes  in  the  IFFC  mode  is  the  paddle  switch.  In  the  IFFC 
modes,  it  provides  the  pilot  with  an  emergency  IFFC  disengage  capability. 
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A  •  Depress  •  Momentary  Push  Sutton 
Side  Force- Rate  Command  to  S/T 
B  -  Momentary  Push  Button 
C  3  Position 
D  -  Momentary 

E  3-Position,  Return  to  Center 
F  •  Momentary  Push  Button 


A  TARGET  DESIGNATOR  CONTROL  (TDC) 

•  UP-DOWN,  LEFT  RIGHT  FOR  RATE  COMMAND 
TO  SENSOR  TRACKER  LINE  OF  SIGHT 

•  DEPRESS  AND  HOLD  FOR: 

•  <  1  SEC  S/T  LOCK  ON* 

•  >  1  SEC  BREAK  LOCK.  RETURN  TO  SLEW 
3  COUPLE  COMMAND 

•  ALTERNATE  ACTION  •  COUPLE/UNCOUPLE 

:  -  MODE  select 

•  AFT  AAG 

•  CENTER  AGG 

•  FORWARD  BMG 

}  -  SIMULATION  CONTROL 

•  1st  DEPRESS  AND  RELEASE  START  SIMULATION 

•  2nd  DEPRESS  AND  RELEASE  STOP  SIMULATION. 
RETURN  TO  INITIAL  CONDITIONS  AND  HOLD 

:  FIELD-OF  VIEW  CONTROL 

•  AFT  AND  RELEASE,  INCREASES  FOV 

•  FORWARD  AND  RELEASE,  DECREASES  FOV 

F  •  FIELD-OF-VIEW 

•  DEPRESS  AND  RELEASE.  DECREASES  FOV 

'Also  used  to  transfer  track  from  point  to  area  track 


Figure  5.  F-15B  -  IFFC  Throttle  Functions  0^w„, 

FIREFLY  III  Control  Panel  -  Figure  6  shows  the  FIREFLY  III  control  panel  and 
describes  the  ATLIS  II  operating  modes  as  selected  by  the  mode  switch.  The  POD  light  is 
illuminated  when  the  POD  is  ready,  typically  about  30  sec  after  selection  of  the  STBY 
mode.  A  flashing  light  indicates  a  pod  over-temperature  condition.  The  laser  switch  is  a 
three  position  guarded  switch.  In  the  OFF  position,  the  laser  can  neither  be  armed  nor 
fired.  In  the  ARM  position,  the  laser  is  armed  and  can  be  fired  by:  (1)  BIT  (into  the 
retro-reflector),  or  (2)  Automatic  vidicon  to  laser  boresight  request  (into  the 
retro-reflector),  or  (3)  automatic  laser  fire  command  on  the  mux  bus,  provided  all  safety 
interlocks  have  been  satisfied  (along  the  existing  tracker  line  of  sight). 

OFF 

•  POD  STOWED 

•  POWER  OFF 

STBY 

•  POD  STOWED 

•  POWER  ON 
CAGED 

•  POWER  ON 

•  POD  UNSTOWED 

•  LOS  CAGED 
OPERATE 

•  LOS  CONTROLLED 
BY  CIU 

•  TRACK  MODES  CRT. 

TAC.  TPT.  LST 

BST  1 

•  TPT  LOCK  ON  STRAIGHT 
AHEAD (LOCKED  OUT 
WHEN  AIRBORNEI 

BST  2 

•  TPT  LOCK  ON  90°  LEFT 
(LOCKED  OUT  WHEN  AIRBORNEI 


Figure  6,  Firefly  in  Control  Final 
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Navigation  Control  Indicator  -  The  pilot  can  use  the  F-15  Navigation  Control 
Indicator  (NCI)  to  change  IFFC  parameters.  Coded  parameters  are  stored  as  "destinations" 
in  the  CC.  The  pilot  depresses  the  Configuration  Select  (CONFIG  SEE)  button  on  the  IFFC 
control  panel  (Figure  4)  to  transfer  these  parameters  from  the  CC  into  the  CIU.  The  NCI 
itself  has  not  been  modified  to  achieve  this  feature.  Only  the  CC  software  which 
interprets  inputs  from  the  NCI  has  been  modified. 

IFFC  Instrumentation  System  -  The  IFFC  Instrumentation  System  is  the  principal  data 
acquisition  system  aboard  the  aircraft.  It  will  collect  analog  data  from  system  elements 
such  as  the  CAS,  and  digital  data  from  the  MIL-STD-1553A  multiplex  bus.  It  can  record 
approximately  250  IFFC  variables  and  telemeter  the  same  information  to  a  ground  receiving 
station. 

IFFC  Video  System  -  The  IFFC  Video  system  allows  the  sensor/tracker  video  to  be 
recorded  on  a  video  tape  recorder  and  displayed  to  the  pilot  on  the  Vertical  Situation 
Display  (VSD)  as  shown  in  Figure  7.  The  video  system  also  includes  two  video  cameras  and 
a  second  video  tape  recorder  to  record  the  HUD  and  VSD  in  a  split  screen  format. 


Figure  7.  Vertical  Situation  Display  ■  IFFC  Mode 


3.  IFFC  I  Tracking/Flight  Control  Features 

The  IFFC  I  system  generates  automatic  tracking  control  input  commands  to  the  IFFC 
modified  CAS  for  the  three  weapon  delivery  modes;  air-to-air  gunnery,  air-to-ground 
gunnery,  and  bombing.  As  shown  in  Reference  2,  the  F-15  CAS  has  been  modified  to  accept 
these  IFFC  tracking  control  (outer  loop)  commands  and  to  tailor  flight  control  (inner 
loop)  performance  for  each  of  the  three  weapon  delivery  modes. 

Air-to-Air  Gunnery  (AAG)  -  The  technique  for  automatic  tracking  control  in  the 
elevation  axis  for  AAG  employs  proportional  control  of  the  elevation  tracking  error  aided 
by  the  pitch  rate  of  the  line-of-sight  to  the  target.  The  pitch  coupler  and  flight 
control  system  thus  matches  the  attacker's  pitch  rate  to  that  of  the  line-of-sight  while 
simultaneously  nulling  the  elevation  tracking  error.  The  technique  for  automatic  tracking 
control  in  the  traverse  axis  employs  the  roll  channel  for  nulling  large  tracking  errors 
and  the  yaw  channel  for  precise  and  rapid  response  tracking.  The  roll  coupler  and  flight 
control  system  roll  the  aircraft  such  that  the  resulting  tracking  error  is  primarily  in 
the  pitch  plane.  This  technique  is  similar  to  that  used  by  fighter  pilots  for  manual 
control.  The  yaw  coupler  and  flight  control  system  then  operate  on  the  remaining 
relatively  small  (less  than  100  rar)  traverse  error  by  matching  the  attacker's  yaw  rate  to 
the  line-of-sight  rate  while  simultaneously  nulling  the  traverse  tracking  error  using 
proportional  control.  An  overview  block  diagram  of  the  AAG  tracking  and  flight  control 
laws  is  given  in  Figure  8. 

The  bandwidths  of  the  pitch,  roll  and  yaw  flight  control  (inner)  loops  of  the  CAS 
have  been  increased  to  accommodate  the  IFFC  tracking  control  (outer)  loops.  This  was  done 
by  increasing  forward  loop  gains  in  all  three  channels  and  scheduling  them  with  dynamic 
pressure.  This  scheduling  provides  a  more  nearly  uniform  response  over  the  IFFC  flight 
test  envelope.  In  addition,  the  pitch  CAS  has  been  reconfigured  from  the  blended  normal 
acceleration  and  cancelled  pitch  rate  feedback  system  used  in  the  baseline  F-15  to  an 
uncancelled  pitch  rate  feedback  system  which  provides  more  precise  pointing  (attitude) 
control.  Also,  the  IFFC  yaw  channel  eliminates  the  lateral  acceleration  feedback,  the 
roll-rate-times-aircraft-angle-of-attack  feedback,  and  the  cancelled  yaw  rate  feedback. 
(These  features  are  provided  in  the  F-15  mode  for  coordinated  flight.  Removing  them 
provides  more  precise  pointing  capability  and  aids  the  flight  control  system  in  matching 
the  yaw  rate  of  the  line  of  sight.)  In  addition,  a  lead-lag  compensation  and  a  roil-rate- 
times-gun-elevation-angle  feedback  is  added  in  the  yaw  channel  to  aid  the  aircraft  in 
rolling  around  the  gunline. 
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A^r~t0~<;T0und  Gunnery  (AGG)  -  The  AGG  tracking  control  has  two  modes,  a  “MIN  TIME" 
mode  anc  a  “MAX  MANEUVER”  mode.  Each  of  these  modes,  in  turn,  consists  of  two  distinct 
phases.  In  the  MIN  TIME  mode,  the  first  phase  (convergence  steering)  is  designed  to  take 
the  aircraft  from  any  attitude  (usually  wings  level)  into  a  banked  accelerating  turn  such 
that  the  aircraft  s  velocity  vector  becomes  aimed  at  a  point  which  is  a  gravity  drop  above 
the  target.  At  this  point,  the  second  phase  (terminal  steering)  takes  over  using  the  same 
tracking  loop  control  laws  as  AAG. 

In  the  MAX  MANEUVER  mode,  the  convergence  steering  is  designed  to  aim  the  velocity 
vector  at  an  offset  point  from  the  point  which  is  a  gravity  drop  above  the  target.  This 
introduces  a  large  traverse  error  at  the  end  of  convergence  steering  which  results  in  more 
sideslip  and  lateral  acceleration  during  terminal  steering.  The  MAX  MANEUVER  terminal 
steering  uses  the  same  automatic  pitch  and  yaw  channel  control  as  AAG,  but  it  allows  the 
pilot  to  manually  control  the  roll  channel.  Flight  testing  will  determine  whether  the  MIN 
TIME  mode  or  the  MAX  MANEUVER  mode  results  in  greater  survivability  with  the  required 
weapon  delivery  accuracy. 

ITie  AGG  flight  control  inner  loops  have  the  same  modif ications  as  the  AAG  loops 
except  that:  (1)  the  yaw  integrator  gain  is  increased  by  a  factor  of  ten,  and  (2)  an 
option  exists  to  introduce  "decoupling"  feedbacks  in  the  pitch  and  yaw  channels  via  the 
CIU.  The  purpose  of  these  feedbacks  is  to  eliminate  inertia-coupling  and  restoring-moment 
effects  (Maa,  Ng8)  from  the  pitch  rate  and  yaw  rate  responses.  This  results  in  more 
precise  control  of  pitch  and  yaw  tracking  loop  rates  which,  in  turn,  improves  pointing 
control. 

Bombing  (BUG)  -  The  IFFC  BMG  mode  uses  a  maneuvering  nonwings- level  delivery  for 
improved  attacker  survivability.  As  in  AGG,  there  is  a  convergence  steering  phase  and  a 
terminal  steering  phase.  The  convergence  steering  is  designed  to  take  the  aircraft  from 
any  attitude  into  a  banked  accelerating  turn  from  which  the  terminal  steering  is  engaged. 
The  convergence  steering  may  be  accomplished  either  manually  or  automatically. 

The  details  of  the  bombing  steering  concept  and  its  associated  equations  are 
explained  in  Reference  (3).  This  concept  results  in  a  parameter  triad  consisting  of 
normal  acceleration,  bank  angle,  and  bomb  release  range  associated  with  the  steering 
commands.  Selection  of  one  of  these  parameters  determines  the  other  two,  and  the 
parameter  selection  provides  the  distinction  between  convergence  and  terminal  steering  as 
shown  in  Figure  9.  Several  combinations  of  manual  and  automatic  control  of  the  pitch  and 
roll  axes  for  both  convergence  and  terminal  steering  will  be  available  as  options  for  IFFC 
flight  test. 

The  IFFC  bombing  tracking  control  employs  proportional  plus  integral  control  in  its 
roll  channel  to  null  the  delta  bank  angle  commanded  by  the  bombing  fire  control  system. 
In  addition,  the  desired  normal  acceleration,  received  from  the  bombing  system,  is 
commanded  as  an  input  to  the  pitch  axis  of  the  flight  control  system. 
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Figure  9.  Bombing  Siooring  Parameter  Tried 


Hie  flight  control  inner  loops  in  the  BMG  mode  are  unchanged  from  the  F-15  baseline 
CAS  in  pitch  and  yaw,  thereby  retaining  the  normal  acceleration  command  and  coordinated 
flight  characteristics  of  the  baseline  F-15  flight  control  system.  In  the  IFFC  CAS  roll 
channel,  the  forward  loop  gain  is  increased  just  as  it  is  for  the  gunnery  modes  in  order 
to  achieve  a  high  bandwidth,  quick  responding  roll  channel. 


4.  IFFC  System  Safety 

Safety  is  a  primary  consideration  for  the  IFFC  program  since  a  simplex  digital 
computer  (CIU)  is  generating  large  authority  command  signals  for  the  dual  F-15B  CAS. 

Built-in-Test  -  The  baseline  F-15  BIT  system  is  designed  to  detect  94%  of  failures  in 
F-15  equipment  and  to  fault  isolate  94%  of  the  failures  detected.  It  checks  circuitry 
which  cannot  be  tested  during  normal  system  operation.  BIT  tests  are  pilot  initiated  and 
can  be  performed  only  on  the  ground  since  they  interfere  with  normal  IFFC  system 
operation. 

The  BIT  system  has  four  major  components: 

o  Baseline  F-15  BIT  system  (including  avionics  initiated  BIT). 

o  Central  computer  initiated  BIT  (including  mux  bus  checks). 

o  CIU  initiated  BIT. 

o  Sensor/tracker  initiated  BIT. 

The  central  computer  initiated  BIT  test  is  expanded  to  include  checks  on  the 
additional  hardware/software  which  provides  the  1553A  bus  controller  capability.  The  CIU 
initiated  BIT  consists  of  tests  which  can  be  categorized  into  three  groups:  CIU  Self 
Test,  Inflight  Integrity  Management  (IFIM)  Valid  Tests,  and  IFFC  System  Tests.  The 
sensor/tracker  initiated  BIT  determines  the  status  of  the  ATLIS  II  with  respect  to 
temperature  and  both  video,  and  laser  tracking  system  operability. 

Inflight  Integrity  Management  -  Inflight  Integrity  Management  monitors  IFFC  system 
operation  in  flight  and  prevents  IFFC  system  engagement,  or  causes  disengagement  when  the 
IFFC  system  is  already  engaged,  if  a  critical  system  failure  is  detected.  The  IFIM  system 
has  four  major  components: 

o  CIU  IFIM  (self  checks  and  IFFC  system  checks). 

o  CAS  IFIM  (dual  circuitry  comparison,  maximum  aircraft  rate  and  acceleration 
disconnects,  and  stick  force  disconnects). 

o  CC  IFIM  (self  checks  and  mux  checks) 

o  Sensor/tracker  IFIM  (overt.emperature,  power  fail,  computer  fail,  and  laser  fail). 

IFFC  Safety  Design  Features  -  The  IFFC  safety  design  features  include:  control 
command  limiters,  engage-d  t-^ngage  switching  logic,  and  laser  fire  command  interlocks. 
The  flight  control  command  limiters  in  both  the  CIU  software  and  in  the  dual  CAS  hardware 
are  attack  mode  dependent.  They  reduce  coupler  authority  as  pilot  input  increases.  In 
addition,  maximum  pitch  rate  and  normal  acceleration  limits  are  adjusted  for  asymmetric 
maneuvers. 


It  is  important  that  a  high  authority  system  such  as  IFFC  be  implemented  such  that  it 
can  be  engaged  and  can  remain  engaged  only  as  long  as  specified  engage  criteria  are  sat¬ 
isfied.  Figure  10  illustrates  the  IFFC  coupler  engage-d isengage  saf  -y  switching  logic 
and  shows  the  involvement  of  the  CIU,  the  CAS,  the  CC,  the  throttle  engage  command,  and 
the  IFFC  control  panel. 


Figure  10.  IFFC  Coupler  EngegefDlsengage  Salety  Switching  Logic 


The  CIU  must  not  only  satisfy  IFIM  checks  for  failures  but  it  must  also  satisfy  other 
IFFC  system  tests  to  engage  the  IFFC  system  or  to  maintain  the  IFFC  system  engaged;  for 
example,  the  attacking  aircraft  must  be  outside  of  minimum  air-to-air  range  and  above 
minimum  air-to-ground  altitude.  In  addition,  the  system  will  be  automatically  disengaged 
at  bomb  release,  and  it  will  be  prevented  from  engaging  if  the  selected  release  range  will 
result  in  a  trajectory  which  violates  the  minimum  air-to-ground  eltitude. 

CAS  logic  interprets  the  meaning  of  the  signal  coming  from  the  IFFC  engage  toggle 
switch  on  the  throttle.  For  example,  unless  all  CAS  IFIM  checks  are  passed,  the  IFFC 
system  cannot  be  engaged  despite  the  engage  signal  from  the  throttle.  Furthermore,  loss 
of  any  engage  parameter  will  remove  the  engage  command  and  automatically  cycle  the  toggle 
switch  to  OFF.  A  pitch-command-rate-of-change  monitor,  which  will  disengage  the  IFFC 
system  if  its  threshold  is  exceeded,  is  also  implemented  in  the  CAS.  The  central  computer 
monitors  mux  bus  performance  and  communication  with  the  CIU.  If  a  failure  is  detected, 
the  CC  enable  signal  to  the  CAS  is  not  issued  and  the  CAS  will  not  accept  command  signals 
from  the  CIU. 

The  ATLIS  II  laser  is  nhibited  from  firing  unless  certain  tests  are  passed.  These 
tests  are  implemented  by  both  the  CIU  and  the  ATLIS  II  pod.  They  test  whether 
sensor/tracker  IFIM  checks  are  satisfied,  IFFC  modes  and  laser  control  are  selected 
correctly,  tracker  lockon  is  maintained,  and  the  landing-gear-up  discrete  has  been 
received. 

5.  System  Operational  Description 

The  IFFC  system  is  designed  to  provide  a  significant  amount  of  flight  test 
flexibility  in  order  to  evaluate  alternate  mechanizations,  to  assess  the  contribution  of 
each  system  element,  and  to  make  changes  as  flight  test  results  dictate.  For  example, 
alternate  system  parameters  can  be  inserted  in  flight  or  between  flights.  In  addition, 
CIU/CC  software  is  structured  to  permit  modification  in  areas  prone  to  change,  and  CAS 
hardware  is  implemented  to  accommodate  flight  test  derived  modif ications.  The  NCI  can  be 
used  in  flight  to  select  alternate  pa-ameters  for  the  coupler,  flight  control,  sensor 
tracker,  fire  control,  symbology,  and  onboard  simulation. 

Three  typical  weapon  delivery  scenarios  and  the  associated  HUD  displays  can  be  used 
to  illustrate  system  operation. 

Air-to-Air  Gunnery  -  Figure  11  shows  a  typical  air-to-air  gunnery  scenario  and 
defines  six  sequential  points  of  the  encounter.  Figure  12  shows  the  IFFC  HUD  symbology 
corresponding  to  points  3,  5,  and  6.  At  point  3,  the  pilot's  objective  is  to  steer  the 
aircraft  such  that  the  reticle  is  centered  on  the  target. 
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Ftgw*  11.  Air-to-AJr  Gunnery  Scenario 
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Figure  12.  HUO  Display  During  IFFC  Air-to-AIr  Gunnery  Scenario 


At  point  5  the  target  is  within  gunnery  range  and  the  IFFC  system  has  been  engaged 
and  is  tracking  the  target.  The  authority  box  indicates  the  maximum  authority  of  the  IFFC 
system.  The  pilot's  objective  is  to  keep  the  reticle  in  the  box  so  that  the  coupler  has 
the  authority  to  automatically  steer  the  reticle  over  the  target.  Hie  shoot  cue  is  on  and 
the  pilot  is  firing. 

The  HUD  display  at  point  6  shows  the  breakaway  cue  which  tells  the  pilot  that  he  is 
too  close  or  is  closing  too  fast.  The  IFFC  system  has  disengaged  at  this  point  and  the 
pilot  should  break  off  the  attack.  Hie  CIU  predicted  number  of  hits,  determined  by  an 
onboard  gunnery  scoring  system,  is  also  being  displayed. 

Air-To-Ground  Gunnery  -  Figure  13  illustrates  a  typical  air-to-ground  gunnery 
scenario  and  defines  eight  sequential  points  of  the  encounter.  Figure  14  shows  the  IFFC 
HUD  symbology  corresponding  to  points  5,  7,  and  8.  The  convergence  steering  line  and  the 
small  box  on  this  line  are  shown  at  point  5.  The  objective  is  to  bank  the  aircraft  so 
that  the  steering  line  becomes  vertical  in  the  HUD,  and  to  command  normal  acceleration 
such  that  the  small  box  is  centered  on  the  reticle.  The  tirae-to-go  before  transition¬ 
ing  to  terminal  steering  is  also  shown. 

The  HUD  at  point  7  (after  IFF C  engage)  shows  the  authority  box.  The  objective  again 
is  to  keep  the  reticle  inside  the  authority  box  so  that  the  IFFC  coupler/flight  control 
system  can  steer  the  reticle  over  the  target.  The  target  is  at  the  center  of  the  reticle, 
and  the  aircraft  is  within  gun  range  so  that  the  shoot  cue  is  on  and  the  pilot  is  firing. 

The  HUD  at  point  8  shows  the  breakaway  cue,  since  the  aircraft  is  still  in  a  dive  at 
a  very  low  altitude. 
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Figure  13.  Alr-to-Ground  Gunnery  Scenario 
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Figure  14.  HUD  Display  During  IFFC  Alr-to-Ground  Gunnary  Scenario 


Bombing  -  Figure  15  illustrates  a  typical  IFFC  maneuvering  bombing  attack  scenario 
and  defines  four  sequential  points  of  the  attack.  Figure  16  shows  the  HUD  symbology 
corresponding  to  the  four  points.  The  HUD  at  point  1  shows  the  manual  convergence 
steering  display  which  functions  the  same  as  for  the  AGG  mode.  The  fact  that  the  target 
is  out  of  the  HUD  field  of  view  is  indicated  by  flashing  the  target  designator  and 
locating  it  along  the  direction  to  the  target.  At  point  2,  the  pilot's  objective  is  to 
keep  the  reticle  inside  the  authority  box  which  enables  the  automatic  IFFC  steering  to 
achieve  the  desired  convergence  steering  commands. 

The  HUD  at  point  3  shows  the  automatic  terminal  steering  at  one  second  prior  to  bomb 
release.  Note  that  the  release  cue  is  almost  passing  through  the  center  of  the  reticle 
and  that  the  actual  range  to  target  is  nearly  the  desired  range  to  target. 

6.  Onboard  Simulation  (OBS) 

The  OBS  mode  is  designed  for:  (1)  ground  and  preflight  checkout  consisting  of  iron 
bird  tests  and  weapon  delivery  closed  loop  tests,  (2)  pilot  familiarization  both  on  the 
ground  and  in  flight,  and  (3)  inflight  checkout  and  evaluation  of  the  IFFC  system,  'nie 
onboard  simulation  capability  (Figure  17)  will  be  very  useful  for  checking  out  the  IFFC 
system  on  the  ground  rather  than  always  using  expensive  flight  testing. 
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Figure  15.  Bombing  Attack  Profile 
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Figure  16.  HUD  Displays  During  IFFC  Bombing  Scenario 


Flgura  17.  Onboard  Simulation  Configurations 
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The  OBS  was  used  extensively  in  ground  testing  on  the  aircraft  and  proved  to  be  a 
very  valuable  troubleshooting  tool.  It  was  used  both  in  closed  loop  checkout  of  the  IPPC 
modified  CAS  as  well  as  the  total  IPPC  system  checkout.  OBS  was  also  used  extensively  in 
the  airworthiness  flight  testing  in  checking  out  the  modified  CAS  as  well  as  the  entire 
IFFC  system  (minus  the  ATLIS  II).  A  detailed  description  of  the  OBS  mode  and  its  imple¬ 
mentation  is  available  in  Reference  4. 


The  OBS  mode  permitted  much  of  the  early  AAG  flight  testing  to  be  done  without  the 
expense  of  having  airborne  targets.  The  OBS  mode  is  also  available  for  AGG  and  BMG. 
Using  the  OBS,  AGG  and  BMG  can  be  checked  out  and  verified  at  a  safe  altitude  by  using 
simulated  "ground  targets"  set  at  an  altitude  well  above  ground  level.  And,  if  the  ATLIS 
II  pod  should  be  unavailable  for  some  period  of  flight  testing,  testing  of  the  remainder 
of  the  IFFC  system  can  proceed  using  OBS  until  the  pod  is  again  available. 

7.  Predicted  Weapon  Delivery  Performance 

IFFC  simulations  were  conducted  on  the  MCAIR  Manned  Air  Combat  Simulator  (MACS)  to 
develop  the  IFFC  system,  to  trade  off  mechanization  alternatives,  and  to  obtain  USAF  test 
pilot  opinions. 

AAG  Simulations  -  Two  configurations  were  evaluated  for  the  AAG  mode;  they  are  termed 
“Snapshoot"  and  "Baseline".  The  Snapshoot  configuration  uses  a  larger  tracking  loop  gain 
(high  bandwidth)  but  can  only  be  engaged  for  relatively  small  levels  of  tracking  error 
(less  than  50  mr) .  The  Baseline  configuration  provides  somewhat  better  tracking  time  and 
hits  on  target;  however,  since  the  Snapshoot  configuration  also  performed  well,  both  were 
retained  for  flight  testing. 

AGG  Simulations  -  Three  AGG  configurations  of  manual  and  automatic  control  were 
evaluated: 


(1)  Manual  convergence,  2  axis  (pitch,  yaw)  terminal. 

(2)  Automatic  convergence,  2  axis  terminal. 

(3)  Automatic  convergence,  3  axis  terminal. 


Figure  18  shows  the  relative  results  for  these  configurations  in  terms  of  expected 
hits  and  total  tracking  time.  Configuration  (3)  outperformed  the  others;  however,  all 
three  configurations  performed  well  enough  to  be  carried  into  IFFC  flight  testing.  All 
configurations  demonstrated  excellent  attacker  survivability  against  ground  targets 
defended  by  anti-aircraft  artillery,  through  the  use  of  maneuvering  deliveries. 
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Figure  It.  Comparison  ol  Throe  IFFC  Alr-to-Ground  Gunnery  Configurations 

Bombing  Simulations  -  Three  BMG  mode  configurations  of  manual  and  automatic  control 
were  evaluated: 


(1)  Manual  convergence,  roll  terminal. 

(2)  Manual  convergence,  pitch-roll  terminal. 

(3)  Automatic  convergence,  pitch-roll  terminal. 

Figure  19  shows  the  results  from  the  simulation  which  indicate  that  configuration  (1) 
outperformed  configurations  (2)  and  (3).  However,  there  were  some  HUD  display  problems 
during  this  BMG  mode  simulation.  For  this  reason,  and  since  they  performed  well,  all 
three  configurations  were  retained  for  IFFC  flight  test.  All  configurations  demonstrated 
excellent  attacker  survivability  against  ground  targets  defended  by  anti-aircraft 
artillery  through  the  use  of  maneuvering  deliveries  and  increased  release  ranges  made 
possible  by  the  accurate  IFFC  bombing  system. 
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Figure  19.  Bomb  Delivery  Accuracy  Comparison  of  Three  Contlgurationa 


8.  Test  and  Evaluation 

The  evaluation  of  the  IFFC  system  includes  the  following  testing  phases: 
o  MACS/ All-Software  Model, 
o  Software  Test  Facility/CAS  Lab. 
o  MACS/Hardware-in-the-Loop  Simulation  (HILS). 
o  Ground  Tests. 


o  Airworthiness  Tests. 


o  Flight  Test. 

MACS/A 11 -Software  Model  -  In  the  first  phase  of  IFFC  testing,  an  all-software  model 
of  the  preliminary  IFFC  system  was  evaluated  in  the  MACS.  The  purpose  of  this  test,  which 
was  conducted  during  the  predevelopment  phase  of  the  IFFC  program,  was  to  select  pri¬ 
mary  and  alternate  configurations  for  further  development  and  flight  testing.  As  a  result 
of  these  tests,  best  control  laws  were  selected,  best  controls  and  displays  configurations 
were  chosen,  and  the  adequacy  of  the  safety  features  was  assessed.  USAF  test  pilots 
participating  in  this  test  provided  many  valuable  suggestions  that  were  incorporated  into 
the  IFFC  system  design. 

An  updated  all-software  model  was  also  evaluated  in  the  MACS.  The  purpose  of  this 
test,  which  was  conducted  during  the  development  phase  of  the  IFFC  program,  was  to:  (1) 
incorporate  an  updated  fire  control  system  and  assess  its  effects  on  IFFC  system 
performance,  (2)  provide  a  first  level  check  on  the  fire  control  portion  of  the  CIU 
Operational  Flight  Program  (OFP)  by  using  the  same  Fortran  as  is  being  used  to  develop  the 
assembly  language  OFP,  (3)  provide  a  "truth*  model  for  use  in  the  Hardware-in-theLoop 
Simulation  (HILS),  (4)  study  potential  problem  areas  such  as  sensor/  tracker  noise  effects 
and  computational  delay  effects,  and  (5)  evaluate  IFFC  HUD  symbology. 

Software  Test  Facility/CAS  Lab  -  After  passing  acceptance  tests  at  the  suppliers' 
facilities,  the  IFFC  hardware  and  software  were  brought  to  MCAIR  for  further  testing. 
This  testing  used  the  F-15  Software  Test  Facility  (STF)  and  the  F-15  CAS  laboratory. 

The  STF  uses  a  host  computer  to  simulate  aircraft  dynamics  and  F-15  avionics 
subsystems.  It  was  used  to  check  out:  (1)  The  1553A  bus  addition  to  the  F-15  CC,  (2)  CC 
interfaces  to  the  HUD,  NCI,  VSD  and  CIU,  (3)  CIU  outputs  to  the  CAS,  and  (4)  HUD  and  VSD 
functioning.  The  F-15  CAS  laboratory  was  used  to  test  and  support  the  IFFC  modified  CAS 
during  the  period  of  Hardware- in-the-Loop  simulation  testing.  A  special  test  bench  had 
been  constructed  for  this  purpose. 

The  STF  operated  in  parallel  with  the  Hardware- in-the-Loop  Simulation  (HILS)  and  the 
ground  testing  on  the  aircraft.  Problems  with  the  CIU  OFP,  which  were  identified  in  any 
of  the  three  facilities,  were  eventually  corrected  with  software  patches  tested  and 
verified  in  the  STF.  During  the  course  of  this  testing,  there  were  approximately  230  such 
changes.  The  STF  was  also  used  to  generate  new  OFP  versions  which  included  these  changes 
configured  as  patches  in  the  previous  version. 

The  STF  was  also  used  to  investigate  CIU  hardware  problems  as  well  as  Central  Com¬ 
puter  (CC)  hardware  and  software  problems.  This  facility  will  be  maintained  throughout 
the  flight  test  program  to  support  the  CIU  and  CC  hardware  and  software. 
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MACS/Hardware- in-the-Loop  Simulation  -  The  next  phase  of  system  checkout  was  the  IFFC 
HILS  in  which  all  IFFC  airborne  hardware  and  software,  except  for  the  sensor/tracker,  were 
assembled  and  tested  in  dynamic  encounters  using  the  MACS  facility  and  the  F-15  Iron  Bird. 
HILS  was  set  up  as  indicated  in  Figure  20.  USAF  and  MCAIR  test  pilots  participated  in  the 
simulation  which:  (1)  integrated  most  of  the  IFFC  hardware/ software  in  a  dynamic 
operational  environment  prior  to  its  incorporation  on  the  F-15B  test  aircraft,  (2) 
verified  F-15B  (non-IFFC)  system  hardware  functions,  (3)  uncovered  and  corrected  IFFC 
system  anomalies,  (4)  verified  on  the  onboard  simulation  operation,  (5)  verified  BIT/IFIM 
module  operation,  and  (6)  verified  the  digital  interface  between  the  instrumentation 
system  and  the  IFFC  system. 


Figure  20.  IFFC  Handware-ln-the-Loop  Simulation  Configuration 

The  HILS  operated  in  parallel  with  the  STF  and  ground  testing  on  the  aircraft. 
During  the  course  of  HILS  testing,  there  were  approximately  110  problems  identified. 
These  problems  can  be  categorized  as  CIO  OFP  errors,  CIU  and  CC  hardware  problems  (e.g., 
parity  errors)  and  system  interface  problems.  The  HILS  was  used  principally  for  identify¬ 
ing  and  investigating  IFFC  system  problems  but  was  also  used  several  times  for  pilot 
training  and  familiarization.  All  three  IFFC  weapon  delivery  modes  were  checked  out  on 
the  HILS  prior  to  flight  testing. 

Ground  Tests  -  IFFC  ground  testing  took  place  following  installation  of  all 
IFFC  I/PP  III  equipment  on  the  F-15B  test  aircraft.  This  testing  ran  in  parallel  with  the 
HILS  and  STF  testing  previously  described.  The  objectives  of  ground  testing  were  to:  (1) 
integrate  flight  ccntrol  and  fire  control  hardware  into  the  F-15B  test  aircraft,  (2) 
verify  F-15B  (non-IFFC)  system  hardware  functions,  (3)  verify  IFFC  functional  operation  in 
the  AAG,  AGG  and  BMG  modes,  (4)  verify  onboard  simulation  operation,  (5)  verify  BIT  and 
IFIM  operation,  (6)  boresight  and  calibrate  system  components,  (7)  verify  instrumentation 
system  integration  with  IFFC  system,  and  (8)  assure  Electromagnetic  Interference/Electro¬ 
magnetic  Compatibility  (EMI/EMC)  compliance  of  the  IFFC  I/FF  III  system  and  the  other  F-15 
avionics  subsystems. 

The  I FFCC  modified  Control  Augmentation  System  was  the  first  piece  of  IFFC  hardware 
tested  on  the  aircraft.  Frequency  response,  time  response,  vibration  tests  and  safety 
feature  verifications  were  run.  One  structural  mode  was  excited  when  the  roll  CAS  gain 
was  raised  to  more  than  three  times  its  production  F-15  level.  This  oscillation  was 
eliminated  with  a  notch  filter  in  the  roll  rate  feedback. 

The  total  IFFC  system  was  then  tested.  This  included  the  IFFC  CAS,  Coupler  Interface 
Unit,  Central  Computer,  Head  Up  Display,  Signal  Data  Processor,  IFFC  and  FF  III  control 
panels,  and  the  ATLIS  II  sensor/ tracker .  The  OBS-on  ground  mode  was  used  for  this 
testing.  During  the  course  of  this  testing,  61  problems  were  identified.  These  consisted 
of  CIU  software  problems,  CIU  hardware  problems  (e.g.,  spikes  on  A/D  converters,  electri¬ 
cal  oscillations  in  the  Load  Factor  Error  Sensor  (LOFES)  biasing  signal,  CIU  parity 
errors),  as  well  as  system-aircraft  interface  problems  (e.g.,  scaling,  signal  polarity). 

The  AAG  mode  was  thoroughly  checked  out  whereas  calendar  time  limitations  permitted 
only  partial  checkout  of  the  AGG  and  BMG  modes.  Nevertheless,  all  safety  features  for  the 
three  modes  were  checked  out.  Checkout  was  accomplished  first  using  a  simulated 
sensor/tracker  and  then  using  the  real  ATLIS  II  sensor/tracker.  Vibration  testing  was 
done  using  the  real  ATLIS  II  sensor/tracker  and  its  associated  target  board.  No  sustained 
oscillations  were  observed. 
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lhe  FF  III  system  tests  were  run  to  verify  proper  ATLIS  XI  functioning  and  to  check 
the  accuracy  of  the  masking  algorithm.  Several  problems  were  encountered  and  corrected 
during  this  period.  The  ATLIS  II  sensor/tracker  was  also  boresighted  as  part  of  these 
tests. 


The  EMI/ EMC  tests  uncovered  three  problems.  The  solutions  involved  one  modification 
to  the  CC  reset  button  in  the  cockpit  and  two  procedural  changes  for  the  IFFC  flight 
manual. 

Airworthiness  Tests  -  The  airworthiness  tests  ensured  that  the  aircraft  with  IFFC 
system  installed  was  safe  and  ready  to  enter  development  flight  tests.  The  aircraft  was 
released  for  airworthiness  flight  tests  upon  satisfactory  completion  of  the  ground  and 
hatdware-in-the-loop  simulation  tests.  Following  satisfactory  completion  of  flight 
readiness  inspections,  a  functional  check  flight  was  flown  by  the  MCAIR  project  pilot. 

The  first  objective  of  airworthiness  test  flights  was  to  confirm  that  the  aircraft 
functions  correctly  in  the  F-15B  mode.  The  second  objective  was  to  verify  that  the  IFFC 
system  functions  safely  and  as  intended.  It  was  not  an  objective  of  airworthiness  tests 
to  assess  the  quality  of  IFFC  system  performance. 

Aircraft  handling  in  the  IFF C  mode  was  evaluated  in  the  middle  of  the  IFFC  flight 
test  envelope.  Outer  loop  tracking  and  inner  loop  flight  control  operations  were  checked. 
The  IFFC  I/FF  III  system  was  engaged  and  disengaged  under  dynamic  maneuvering  conditions 
to  check  for  transients.  Twelve  airworthiness  test  flights  were  made  during  the  March  to 
May  81  time  period.  The  system  features  tested  included: 

o  Safety  Disconnects 

o  Modified  CAS  Operation 

o  Onboard  Simulation  -  AAG  Mode 

o  Onboard  Simulation  -  BMG  Mode 

o  ATLIS  II  Operation  -  AA  Mode 

o  ATLIS  II  Operation  -  AG  Mode 

These  tests  were  performed  "in  the  middle"  of  the  IFFC  flight  test  envelope;  specifically 
the  flight  conditions  of  .7  Mach  and  .9  Mach  at  15,000  feet  altitudes.  CAS  and  coupler 
gains  were  adjusted  and  some  ATLIS  II  modifications  were  made  to  improve  video  quality 
based  on  results  from  these  flights.  The  IFFC  system  performed  well  and  the  ATLIS  II 
target  tracking  capability  was  demonstrated. 

Flight  Test  -  The  first  nine  months  IFFC  flight  test  program  were  planned  by  MCAIR 
and  are  being  conducted  by  Air  Force  Flight  Test  Center  (AFFTC).  The  following  six  months 
will  be  conducted  by  the  USAF.  The  associated  contractor's  FF  III  instrumentation  and 
test  requirements  were  incorporated  in  the  flight  test  plan.  Testing  is  following  the 
usual  confidence  buildup  approach  by  progressively  investigating  the  IFFC  system  from  zero 
to  full  authority  automatic  control  for  the  three  IFFC  modes  (AAG,  AGG  and  BMG). 

It  is  important  in  a  flight  test  effort  to  be  able  to  adjust  and  refine  the  flight 
test  plan  on  a  flight-by- flight  basis.  Quick-look  data  will  be  obtained  from  the  onboard 
telemetry  and  from  video  tape  replay.  It  will  permit  rapid  dissemination  of  quick-look 
reports. 

The  IFFC  I/FF  III  flight  test  envelope  is  shown  in  Figure  21.  The  load  factor, 
flight  path  angle,  and  bank  angle  limitations  are  noted.  The  26000  ft  altitude  and 
subsonic  Mach  number  restrictions  were  imposed  to  reduce  the  cost  and  schedule  of  the 
demonstration  program.  They  do  not  represent  technology  limitations. 

The  flight  test  program  began  in  June  81  at  The  Air  Force  Flight  Center,  Edwards  AFB. 
It  will  consist  of  150  test  flights,  50  each  for  AAG,  AGG  and  BMG.  Approximately  100 
flights  will  be  allocated  to  IFFC  system  development  and  50  flights  to  formal  evaluation. 

The  first  flight  test  phase  addressed  preliminary  functional  testing.  This  phase 
involved: 

o  Checkout  of  the  Onboard  Instrumentation  and  Video  Systems 
o  Verification  of  Correct  Gun  Operation  and  Alignment 
o  A  HUD/Windshield  parallax  assessment 
o  Determination  of  Bomb  Ejection  Velocity  and  Delays 
o  Validation  of  HUD/Gun  Alignment 

o  Investigation  for  Possible  Radar  Range  and  Range  Rate  Bias 
o  Air  Force  IFFC  Pilot  Training  and  Familiarization. 
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Figure  21.  IFFC  Flight  Test  Envelop* 

The  second  phase  will  involve  IFFC  system  integration.  The  purpose  of  this  phase, 
which  will  consist  of  approximately  25  flights,  is  to  verify  the  proper  functioning  of  the 
CAS,  CIU  software/hardware,  and  the  ATLIS  II  sensor/tracker  in  all  three  IFFC  weapon 
delivery  modes.  At  the  end  of  this  phase,  there  should  be  no  major  implementation  errors 
and  the  IPFC  system  should  be  ready  for  the  development  testing  phase  in  which  performance 
will  be  optimized.  The  specific  objectives  of  Phase  2  are: 

o  OBS  Checks 

o  Tracker  Target  Acquisition  and  Noise  Tests 
o  Encounter  Profile  Development 
o  Tracker  Masking/INS  Node  Assessment 
o  Target  State  Estimator  Validation 
o  Director  Fire  Control  Assessment 

o  Onboard  Scoring  Correlation  with  Ground  Based  Progams 
o  Coupler  Checkout  and  Authority  Buildup 
o  Bomb  Algorithm  Assessment 
o  ATLIS  II  Operation 
o  Integrated  System  Test3  (3  Modes) 

The  third  phase  of  flight  test  will  be  the  Development  phase  where  the  main  objective 
is  to  modify  IPFC  system  parameters  to  improve  and  optimize  system  performance. 

ttie  fourth  phase  will  be  the  Air  Force  Evaluation  in  which  the  objective  is  to 
generate  statistically  significant  quantities  of  data  to  determine  the  improvement  in 
weapon  delivery  performance  of  the  optimized  IFFC  system  relative  to  performance 
improvement  predictions  and  program  goals. 

The  fifth  and  last  phase  will  be  performed  at  Air  Force  Tactical  Fighter  Weapon 
Center  at  Nellis  AFB.  A  realistic  anti-aircraft  artillery  environment  will  be  available 
to  assist  in  evaluating  improvements  in  survivability  during  air-to-ground  weapon 
delivery. 

Conclusions 
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An  Integrated  Flight  and  Fire  Control  (IFFC)  System  has  been  designed  and  built, 
laboratory  tested,  ground  tested  on  the  test  aircraft  and  is  currently  being  demonstrated 
in  flight  on  an  F-15B  aircraft.  Studies  and  simulations  indicate  that  the  IFFC  system  can 
provide  excellent  weapon  delivery  accuracy  with  reduced  pilot  workload  for  air-to-air 
gunnery,  air-to-ground  gunnery,  and  bombing.  Very  good  attacker  survivability  for  the 
interdiction  of  anti-aircraft  artillery  defended  ground  targets  through  the  use  of 
maneuvering  deliveries  is  also  Indicated.  Flight  testing  of  the  IFFC  system  began  in  June 
1981  to  verify  the  improved  accuracy  and  attacker  survivability  predicted  in  the  studies 
and  simulations.  A  15  month  flight  test  program  is  planned. 
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SUMMARY 

The  expanding  role  of  the  helicopter  in  the  battlefield  environment 
has  burdened  the  pilot  with  missions  of  greater  complexity  and  risk 
with  a  concomitant  increase  in  pilot  workload.  Navigation  of  the 
helicopter  is  an  essential  supportive  element  to  the  prime  mission 
and  has  until  recent  years  been  a  significant  contribution  to  the 
workload.  Technological  advances  in  navigational  electronics  such 
as  Doppler  navigation  radar,  computers,  integrated  avionic  control 
and  display  systems,  etc.,  now  can  provide  automated  navigation  with 
vital  benefits  in  cost,  size,  weight  and  power  which  permit  incor¬ 
poration  of  these  advances  into  the  helicopter.  Cost  reductions  are 
particularly  important  since  helicopters  are  used  in  large  quanti¬ 
ties  in  modern  military  forces.  Multi-sensor  navigation  systems 
already  available  and  in  use  in  helicopters  are  discussed  followed 
by  a  review  of  the  system  trade-offs  and  considerations  leading  to 
new  systems  that  use  more  advanced  digital  electronic  techniques  to 
achieve  the  goals  of  reduced  pilot  workload,  improved  performance  at 
minimum  size,  weight,  and  cost.  The  beneficial  impact  of  ongoing 
technological  advances  in  improving  the  operating  capabilities  of 
future  avionics  systems  is  indicated. 


IMPACT  OF  HELICOPTER  MISSION  REQUIREMENTS  ON  NAVIGATION 

The  military  helicopter  has  been  given  a  continuously  expanding  role  both  on  land  and  at 
sea.  Helicopter  missions  include  rescue,  reconnaissance,  troop  delivery,  attack  and 
weapon  delivery.  These  missions  are  often  performed  under  active  battlefield  stress  and 
may  require  the  pilot's  full  attention  for  the  accomplishment  of  the  mission  objective. 
To  permit  the  pilot  to  cope  with  the  workload  imposed  by  more  demanding  mission  tasks,  it 
has  become  necessary  to  relieve  him  through  automation  of  some  of  those  supportive  func¬ 
tions  which  have  been  historically  performed  manually.  One  of  those  supportive  func¬ 
tions  which  technology  has  permitted  to  be  automated  is  precise  navigation. 

Under  favorable  conditions  of  visibility  and  unrestricted  altitude  the  pilot  workload 
associated  with  manual  map  and  compass  navigation  may  be  tolerable.  However  the  battle¬ 
field  environment  no  longer  permits  the  helicopter  to  fly  at  the  300  to  500  foot  alti¬ 
tudes  which  allow  the  pilot  or  navigator  to  navigate  using  simple  visual  terrain  and  map 
correlation.  Experience  in  recent  conflicts  has  proven  the  vulnerability  of  the  heli¬ 
copter  when  it  is  exposed  at  these  altitudes.  Ultra-low  altitude  flight  (under  50  feet) 
increases  the  survivability  of  these  craft  from  enemy  ground  fire,  but  makes  VFR  flying 
by  use  of  map  and  compass  difficult.  Any  tactical  incident  will  almost  surely  cause  the 
pilot  or  navigator  (if  there  is  one)  to  lose  track  of  his  position  and  become  disoriented 
even  in  clear  weather.  This,  coupled  with  the  expectation  that  battlefields  of  the 
future  will  be  active  at  night  and  in  inclement  weather,  makes  map  and  compass  dead 
reckoning  navigation  highly  impractical. 

Figure  1(a)  depicts  the  functions  which  in  the  past  had  to  be  performed  manually  by  a 
pilot  in  order  to  navigate.  He  served  as  a  data  gatherer  and  computer  to  combine  the 
outputs  of  several  sensors  to  derive  the  navigation  output.  Air  speed,  attitude, 
heading,  drift  angle,  and  altitude  are  the  major  inputs  which  he  must  read  and  combine  to 
plot  his  position  on  a  map.  He  eliminated  accumulated  errors  in  his  dead  reckoning 
computation  by  periodic  updates  provided  by  visual  ident i f ica t ion  of  local  terrain 
features,  a  procedure  which  is  highly  ineffective  at  night,  in  poor  visibility  or  at  low 
altitudes.  Manual  dead  reckoning  is  an  acceptable  technique  when  missions  and  heli¬ 
copters  are  simple,  but  with  the  increasing  workload,  stress,  and  con fusion  during 
today's  tactical  situations,  it  no  longer  is  adequate. 


These  problems  demanded  the  development  of  integrated  avionics  to  provide  automatic 
navigation  to  reduce  pilot  workload  and  supply  him  with  position,  steering  and  guidance 
information  and  true  ground  velocity  for  many  purposes  besides  navigation. 
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Considerations  of  survivability  and  the  possibility  of  providing  these  outputs  using 
on-board  sensors  favored  a  self-contained  navigation  system  as  opposed  to  ground-based 
aids  which  could  be  jammed,  spoofed  or  subject  to  attack. 

DEVELOPMENT  OF  CURRENT  RESPONSE  TO  BASIC  NAVIGATION  NEEDS 

An  Integrated,  Automatic  Helicopter  Navigation  System 

The  system  considerations  discussed  above  indicate  the  need  for  an  automatic  navigation 
system  that  would,  in  effect,  replace  the  pilot's  manual  navigation  task  with  a  computer. 
This  allows  one  to  take  advantage  of  the  computer's  greater  capability  by  adding  addi¬ 
tional  navigation  sensors  that  are  more  accurate  and  that  further  reduce  his  workload. 
For  example,  it  now  becomes  possible  to  replace  the  airspeed  sensor,  which  requires  the 
pilot  to  estimate  wind  magnitude  and  direction,  with  a  direct,  automatic  groundspeed 
measuring  sensor  such  as  a  Doppler  radar.  Figure  1(b)  shows  the  result  of  applying  these 
new  capabilities  to  the  navigational  procedures  outlined  in  Figure  1(a). 

The  navigation  and  guidance  data  generated  by  the  computer  shown  in  Figure  1(b)  must  be 
displayed  in  a  manner  that  minimizes  the  amount  of  interpretation  required  by  the  pilot 
to  translate  them  into  helicopter  control  actions.  The  most  desirable  approach  is  to 
enable  the  pilot  to  enter  the  coordinates  of  destinations  or  targets  prior  to  or  during 
flight,  and  to  cause  the  computer  to  generate  a  left-right  steering  signal  which,  when 
zeroed,  causes  the  helicopter  to  fly  toward  the  selected  destination.  The  approach 
greatly  reduces  the  time  spent  by  the  pilot  with  a  hand-held  map,  and  the  greater  accur¬ 
acy  of  such  a  navigation  system  reduces  the  required  frequency  of  position  updates  and 
hence  further  reduces  the  pilot's  map  reading  tasks. 

The  U.S.  Army,  recognizing  the  need  for  an  automatic  navigation  system  such  as  that  shown 
in  Figure  1(b),  chose  a  Doppler  Radar  Velocity  Sensor  (DRVS)  for  the  direct,  automatic 
groundspeed  measuring  sensor.  The  selection  of  this  type  of  a  velocity  sensor  is  appro¬ 
priate  for  several  reasons: 

•  It  is  self-contained. 

•  It  can  provide  accurate  data  throughout  the  speed/altitude  profile  of  a  heli¬ 
copter,  namely,  from  negative  (backward)  flight  through  hover  to  positive 
(forward)  flight. 

•  Accuracy  is  independent  of  time  and  hence,  of  the  length  of  the  mission. 

•  It  provides  instantaneous  reaction  time, 

•  It  is  all  solid  state  and  has  no  moving  parts. 

•  A  Doppler  radar  has  a  lower  Life  Cycle  Cost  (LCC)  in  comparison  to  other  types 
of  velocity  sensors,  and  thus  is  affordable  for  large  quantities  of  heli¬ 
copters. 

Kearfott  had  already  begun  development  of  a  Doppler  system  having  these  characteristics 
when  the  Army  translated  these  requirements  into  a  specification.  The  development  was 
completed  under  Army  sponsorship  to  produce  the  AN/ASN-128  Lightweight  Doppler  Naviga¬ 
tion  System  shown  in  Figures  2  and  3. 

The  Receiver-Transmitter-Antenna  (RTA)  and  Signal  Data  Converter  (SDC)  form  the  DRVS. 
The  RTA  contains  the  antenna  with  its  integral  radome,  R.F.  components  for  transmitting 
and  receiving  electromagnetic  signals,  and  electronics  to  condition  the  resultant  sig¬ 
nals.  The  SDC  receives  the  conditioned  signals  from  the  RTA,  measures  the  Doppler 
shifts,  and  converts  these  into  the  digital  form  required  by  the  computer.  The  Computer 
Display  Unit  (CDU)  contains  a  custom  LSI  digital  computer  and  memory  that  perform  all 
navigation  and  guidance  computations,  and  displays  the  results  on  its  front  panel.  Entry 
of  destination  coordinates  and  other  data  are  made  via  a  keyboard,  while  control  switches 
are  provided  for  mode  and  display  control  selection.  The  Steering-Hover  Indicator  Unit 
(SHIU)  displays  guidance  data  to  the  pilot  in  "analog"  form,  that  is,  as  pointers  and 
needj.es  although  it  also  contains  a  numeric  readout  of  distance-to-go.  The  SHIU  is  an 
optional  addition  to  the  system. 

The  AN/ASN-128  provides  accurate  navigation  over  the  flight  parameters  listed  below: 
Along-heading  velocity  -  -50  to  +350  knots  (-93  to  +650  km/h) 

Cross-heading  velocity  -  +100  knots  (+185  km/h) 

Vertical  velocity  -  +5000  ft/min  (+1500  m/min) 

Altitude  -  0  to  10,000  ft  (0  to  3000  m)  above  ground  level 

Land  Water 

Attitude  -  Pitch  -  +30°  +20° 

Roll  -  +45°  +30° 


L 
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Accuracy  of  the  AN/ASN-128  can  be  stated  for  the  DRVS,  alone,  and  for  the  computed  posi¬ 
tion  after  Doppler  velocity  data  are  combined  with  heading  from  the  on-board  heading  ref¬ 
erence. 

Doppler  Radar  Velocity  Sensor  Accuracy  (one-sigma) 

Along  heading  0.25%  +  0.1  knot 

Cross-heading  0.25%  +  0.1  knot 

Vertical  velocity  0.1%  +  0.05  knot 

Position  accuracy  is  1.3%  (CEP)  of  distance  traveled  when  heading  reference  accuracy  is 
one  degree  (one-sigma) 

Physical  characteristics  of  the  AN/ASN-128  and  SHIU  are  listed  below. 


AN/ASN-128 

WEIGHT 

_ 

VOLUME 

POWER 

MTBF 

kg 

lb 

cm"* 

(W) 

(h) 

DRVS :  RTA 

4.76 

10.5 

7,752 

473 

12.0 

12,237 

SDC 

5.67 

12.5 

9,296 

564 

56.6 

7,744 

DRVS  Total: 

10.43 

23.0 

17,048 

1,037 

68.6 

4,742 

CDU 

3.18 

7.0 

3,676 

224 

30.0 

3,838 

Total: 

13.61 

30.0 

20,724 

1,261 

98.6 

2,121 

SHIU 

0.91 

2.0 

1,067 

65 

15.0 

10,000 

The  AN/ASN-128  provides  accurate  present  position,  steering  signals  and,  distance  and 
time-to-go  to  10  destinations.  It  uses  a  printed  grid  antenna  that  is  self-compensating 
for  the  over-water  shift.  Navigation  data  are  displayed  in  both  UTM  coordinates  and 
latitude/longitude. 

Other  operational  advantages  include: 

•  single  transmit-receive  antenna  makes  maximum  use  of  the  available  aperture, 
which  minimizes  random  errors  -  important  for  accurate  fire-control. 

•  back-up  modes  should  heading,  or  pitch  and  roll,  or  Doppler  velocity  become 
unavailable. 

•  no  maintenance  adjustments  at  any  support  level. 

•  no  special  test  equipment  at  the  flight  line:  BITE  localizes  malfunctions  to 
the  LRU  and  SRU  levels. 

•  CDU  provides  serial  digital  outputs  of  system  navigation,  guidance  and  other 
data  for  use  by  external  avionics 

Description  of  the  AN/ASN-128  and  the  SHIU 

The  AN/ASN-128  Lightweight  Doppler  Navigation  system  consists  of  three  boxes  that  weigh 
only  30  pounds  in  total  and  have  a  predicted  MTBF  of  over  2100  hours.  The  auxiliary 
display  unit,  the  SHIU,  weighs  only  2.0  pounds,  and  has  an  MTBF  greater  than  10,000 
hours . 

The  design  of  the  AN/ASN-128  was  centered  on  making  maximum  use  of  the  existing  heading 
and  attitude  sensors  and  complementing  these  with  a  DRVS,  a  computer,  and  suitable  con¬ 
trols  and  displays. 

A  Doppler  radar  consists  of  an  antenna,  RF  transmitting  and  receiving  components,  and 
electronics  for  processing  the  Doppler  frequency  shifts  and  converting  these  into  the 
desired  data  format.  A  body-mounted  antenna  was  selected  to  avoid  gimbals  that  would 
otherwise  add  considerable  size,  weight  and  complexity.  Four  beams  of  R.F.  energy 
directed  downward  symmetrically  around  the  nadir  are  sequentially  transmitted  by  a 
single  antenna  toward  the  ground,  and  the  back-scattered  energy  is  then  sequentially 
received  and  processed.  Although  three  beams  are  sufficient  to  determine  the  three 
orthogonal  components  of  helicopter  velocity,  the  AN/ASN-128  uses  a  fourth  redundant 
beam  to  enable  self-checking  of  the  overall  reliability  of  the  velocity  measurement. 

The  antenna  must  be  mounted  on  the  helicopter's  underside  to  enable  its  beams  to  illumi¬ 
nate  the  ground,  and  thus  installation  and  removal  is  generally  more  difficult  than  that 
of  an  electronics  box  mounted  in  an  avionics  bay.  The  antenna  unit  was  therefore 
designed  to  contain  the  minimum  amount  of  electronics  for  maximum  reliability, 
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(>  12,000  h)  but  it  does  include  all  transmit  and  receive  R.F.  components  so  that  wave¬ 
guide  runs  within  the  fuselage  are  avoided.  A  Kearfott  developed  printed  grid  antenna 
was  used  to  eliminate  the  weight  and  cost  of  waveguide  arrays.  Installation  was  further 
simplified  by  integrating  the  radome  into  the  antenna.  All  electronics  required  tor 
velocity  processing  are  contained  in  a  separate  electronics  box,  the  SDC,  located  in  the 
avionics  bay.  All  regulated  voltages  required  by  the  RTA ,  SDC,  CDU  and  SHIU  are  provided 
by  a  single  power  supply  in  the  SDC.  A  single  card  in  the  SDC  sequentially  converts  the 
synchro  outputs  of  the  existing  heading,  attitude  and  true  airspeed  sensors  into  digital 
form  for  use  by  the  computer  in  the  CDU. 

All  computations  for  the  AN/ASN-128  including  velocity  coordinate  transformations,  navi¬ 
gation  in  both  UTM  and  latitude  and  longitude  coordinates,  steering  signals  to  ten  desti¬ 
nations,  and  BITE  functions,  are  performed  in  an  LSI  digital  computer  located  in  the  CDU. 
This  approach  minimizes  the  cost  of  the  RTA  and  SDC  when  only  these  two  boxes  are  used  as 
a  DR VS . 

Two  types  of  BITE  test  are  provided;  continuous  and  manually  initiated  tests.  The  CDU 
and  most  portions  of  the  SDC  and  RTA  are  continuously  tested,  and  the  overall  SDC  and  RTA 
are  tested  from  end-to-end  during  the  manually-initiated  test.  All  test  results  are  dis¬ 
played  on  the  CDU:  system  status,  the  failed  box,  and  the  failed  module  within  that  box. 
"GO"  is  displayed  when  no  failure  has  occurred.  End-to-end  test  takes  only  18  seconds 
and  does  not  interrupt  navigation  and  guidance  computations. 

The  system  has  been  in  production  since  1978  and  to  date  over  1000  LDNS  systems  have  been 
ordered  of  which  600  have  been  delivered  to  the  U.S.  Army  for  installation  in  the  AH-1S 
Cobra  and  the  UH-60A  Black  Hawk  helicopters.  The  system  has  been  selected  by,  and  is 
being  manufactured  for  several  other  countries,  including  Germany,  Spain,  Greece  and 
Australia;  additional  orders  have  been  received  from  these  countries  for  over  600 
systems . 

Mission  Effectiveness 


The  above  section  describes  some  of  the  trade-offs  leading  to  the  system  architecture, 
performance  and  physical  characteristics  of  the  navigation  systems.  The  system  designer 
together  with  the  operational  personnel  must  also  examine  the  effectiveness  of  the 
system  in  performing  the  planned  mission.  To  accomplish  this  a  multi-segment  mission  is 
examined  in  the  following  section  to  identify  the  various  requirements  of  the  navigation 
system.  Figure  4  shows  the  selected  hypothetical  yet  typical  mission  scenario  for  a 
utility  helicopter.  This  is  followed  by  a  discussion  of  the  capability  of  the  AN/ASN-128 
to  satisfy  these  requirements. 

The  postulated  mission  commences  at  the  Forward  Area  Rearming  and  Refueling  Point 
(FARRP) .  Coordinates  in  either  UTM  or  Lat/Long  format  of  the  planned  destinations  or 
other  preselected  stored  data  should  be  rapidly  insertable  into  the  navigation  system.  A 
dual  coordinate  capability  is  desirable  should  target  handoff  be  required.  Rapid 
deployment  unencumbered  by  requirements  for  lengthy  alignment  times  is  essential.  BITE 
check  should  be  rapid  yet  provide  high  confidence.  The  helicopter  will  pass  the  Forward 
Edge  of  the  Battle  Area  (FEBA)  enroute  to  Lz  Tiger  for  a  supplies  drop.  Once  past  the 
FEBA  minimum  radiated  emission  is  desirable  to  avoid  ECM.  Enroute  the  flight  crew  must 
be  provided  with  present  position,  off-track  error,  distance  to  go,  true  ground  speed  and 
track  angle.  On  landing  at  Lz  Tiger,  it  is  assumed  that  power  would  be  turned  off 
requiring  that  selected  destination  stored  data  not  be  destroyed.  Should  the  battle 
environment  not  allow  a  touchdown  landing  the  system  must  display  hover  guidance  data. 
Enroute  to  Lz  Argo,  enemy  action  may  cause  the  helicopter  to  depart  from  its  planned 
course.  Instantaneous  call-up  of  present  position  to  allow  reporting  of  the  encounter, 
and  updated  guidance  to  Lz  Argo  must  be  provided.  Having  arrived  over  Lz  Argo  which  is  a 
point  of  known  position,  a  means  to  quickly  update  for  any  accumulated  navigation  error 
is  desirable.  The  navigation  system  must  be  configured  to  continue  navigation  through¬ 
out  the  update  to  avoid  error  buildups  should  higher  priority  tasks  delay  completion  of 
the  update. 

After  updating  at  Lz  Argo  and  while  enroute  to  the  next  planned  destination,  Lz  Judy,  the 
aircraft  is  rerouted  to  an  unplanned  landing  zone  -  Lz  OX.  The  system  must  be  capable  of 
in-flight  alternate  destination  entry  and  selection. 

Having  completed  the  mission  function  at  Lz  OX  the  system  should  provide  the  ability 
simply  to  call  up  the  prestored  destination  Lz  Judy  and  provide  all  guidance  and  steering 
commands  required  to  reach  that  LZ. 

Enroute  to  Lz  Judy  a  target  of  opportunity  is  observed,  namely  a  pontoon  bridge  over  a 
stream.  The  ability  to  over-fly  this  target  and  automatically  store  and  display  its 
position  is  required.  Should  operational  conditions  prevent  over-flight  it  is  desirable 
to  have  an  offset  target  of  opportunity  storage  capability. 

The  revised  flight  path  to  Lz  Judy  requires  flying  over  a  large  body  of  water  with  an 
undulating  shoreline.  A  navigation  system  which  automatically  provides  over-water  com¬ 
pensation  eliminates  the  need  for  the  flight  crew  to  manually  activate  a  land-sea  switch. 
This  feature  is  operationally  desirable  and  in  fact  mandatory  for  nighttime  and  all 
weather  flying  when  passage  over  water  is  not  detectable. 


For  night  flying  it  is  essential  that  the  navigation  system  controls  and  displays  be 
compatible  with  night  vision  goggles. 


Should  the  water  conditions  be  extremely  smooth,  thereby  not  providing  adequate  radar 
return,  the  system  should  be  capable  of  storing  last  "good"  velocity,  or  when  provided 
with  True  Air  Speed  (TAS)  be  able  to  compute  and  store  most  recent  wind  speed  for  navi¬ 
gating  in  these  periods  of  Doppler  "Memory." 

Departing  Lz  Judy  the  helicopter  may  encounter  a  rainstorm.  It  is  mandatory  that  the 
navigation  system  be  insensitive  to  echoes  from  near-in  targets  like  rain  which  could 
provide  erroneous  velocity  inputs. 

Approaching  the  FEBA  it  is  desirable  to  obtain  a  final  position  update  to  ensure  that  the 
helicopter  will  penetrate  in  a  safe  area.  This  updating  again  must  be  simple  and  quickly 
per  formed. 

After  safely  passing  through  the  FEBA  and  prior  to  reaching  the  FARRP,  the  ability  to 
perform  an  in-flight  BITE  check  would  enable  rapid  ground  maintenance  action  (if 
required)  upon  landing  thereby  permitting  rapid  redeployment. 

Rapid  redeployment  doctrine  requires  that  those  elements  of  the  navigation  system  having 
the  lowest  reliability  be  located  in  the  most  easily  accessible  location,  thus  allowing 
minimum  flight  line  level  maintenance  times. 

The  AN/ASN-128  navigation  system  is  highly  compatible  with  the  above  mission  needs. 

•  Its  navigational  features  include: 

-  Either  UTM  or  Lat/Long  operation  for  Target  Handoff 

Storage  of  up  to  four  "Targets  of  Opportunity" 

Ability  to  enter  and  store  up  to  ten  destinations. 

Storage  is  retained  with  prime  power  removed. 

The  following  guidance  signals: 

-  CDU  -  Ground  speed  and  track  angle 

-  Track  angle  error  and  distance  off  course 

-  Distance,  Bearing  and  Time  to  go  to  destination 

-  wind  speed  and  direction 

-  Present  position  (Lat/Long  or  UTM) 

-  SHIU  -  Track  angle  error  or  distance  off  course 

-  Ground  speed 

-  Distance  to  go 

-  3D  hover  guidance 

•  It  provides  many  unique  operational  features,  some  of  which  are: 

Automatic  over-water  compensation 
Automatic  wind  computation  when  provided  with  TAS 
Reversion  to  last  remembered  velocity  when  in  Memory 
Immunity  from  rain  effects 

Capability  to  erase  stored  destination  data 
Warm-up  time  of  less  than  5  seconds 

A  complete  system  check  using  BITE  without  the  need  for  external  GSE .  The 
BITE  function  may  be  exercised  in  flight  without  degrading  navigation  and 
guidance 

An  error  code  on  the  CDU  display  identifying  the  defective  LRU  and  SRU 
Backup  modes  of  operation  to  overcome  loss  of  information  from: 

Vertical  gyro 
Heading  reference 
Doppler  radar 

A  display  which  is  compatible  with  night  vision  goggles 

In  addition,  because  the  radiation  patterns  are  directed  nearly  straight  down  and  the 
radiated  power  is  very  low  (20  mW)  the  system  has  extremely  low  ECM  detect ibi 1 i ty. 


IMPACT  OF  EXPANDED  AVIONICS  REQUIREMENTS 


Although  the  AN/ASN-128  entered  production  as  recently  as  1978,  the  pace  of  an  ever 
increasing  enemy  threat  both  in  lethality  and  in  quantity  of  air  forces  and  armor  has 
significantly  enlarged  the  mission  requirements  for  future  helicopters.  The  requirement 
to  routinely  conduct  operations  at  Nap  Of  the  Earth  (NOE)  altitudes  in  marginal  weather 
under  reduced  visibility  has  placed  ever  increasing  demands  upon  the  onboard  avionics. 

More  accurate  and  sophisticated  fire  control  systems  coupled  to  LASER  designators,  FLIR 
and  highly  accurate  attitude  and  velocity  reference  systems  are  required.  To  counter  the 
ECM  threat,  improved  and  multi-frequency  communication  systems  have  been  developed  and 
are  being  deployed.  These  demands  have  significantly  increased  the  number  of  electronic 
systems  on  board  helicopters,  resulting  in  the  problems  of  increased  crew  workload, 
cockpit  space  requirements,  system  cost  and  weight. 

Use  of  Digital  Data  Bus  Technology 

The  increasing  amount  of  electronics  systems  requires  the  transfer  of  large  amounts  of 
digital  data  at  very  high  rates.  To  meet  this  requirement,  digital  signal  processing 
techniques  and  architectures  are  being  applied  to  interconnect  sensors,  displays  and 
controls  and  multiple  avionics  microprocessors  at  the  subsystem  level. 

The  standard  specification  developed  by  the  United  States  military  for  serial  data 
multiplex  transmission  is  MIL-STD-1553A/B.  Military  aircraft  of  the  1980's  will  rely 
heavily  on  multiplex  data  buses  for  information  distribution  in  the  design  of  their 
avionics  architecture.  In  addition,  the  recently  released  MIL-STD-1760  specifies  that 
both  expendable  and  non-expendable  stores  be  capable  of  interfacing  with  the  host  air¬ 
craft  via  a  -1553B  digital  multiplex  (MUX)  bus.  The  -1553  digital  multiplex  bus  provides 
a  means  of  transferring  data  and  commands  from  remote  avionics  over  the  same  transmission 
line  -  in  this  case,  a  shielded  twisted  pair.  The  use  of  a  digital  data  bus  reduces 
weight  and  improves  reliability  because  less  wire  and  fewer  connectors  are  required. 
Digital  transmission  techniques  provide  a  higher  data  capacity,  selfcheck  on  each 
transmission  and  reduced  susceptibility  to  electromagnetic  interference. 

Key  to  the  development  and  utilization  of  the  digital  data  bus  is  the  MIL-STD-1553  Bus 
Controller  and  Multiplex  Remote  Terminal  (BC/RT)  which  provides  the  interface  between 
the  aircraft  1553  MUX  system  and  the  on-board  avionics  unit  in  which  it  is  contained. 
Singer-Kearfott  has  developed  a  multiplex  terminal  unit  of  universal  applicability  for 
use  in  avionic  LRU's.  The  BC/RT  Module  described  in  the  following  section  utilizes  high- 
density  microcircuits  and  a  flexible  two-part  architecture  which  is  virtually  inde¬ 
pendent  of  host  peculiar  requirements,  and  is  therefore  usable  in  a  wide  range  of  appli¬ 
cations  with  little  or  no  modification.  It  is  designed  to  be  located  in  the  host  LRU 
since  the  entire  module  is  packaged  on  a  single  card  and  requires  less  than  10  watts. 

The  BC/RT  can  operate  as  a  controller  or  as  a  remote  terminal.  The  mode  of  operation  is 
selectable  by  a  Master/Slave  logic  signal  or  via  the  -1553  mode  command  for  dynamic  bus 
control  transfer. 

When  designated  a  remote  terminal,  the  BC/RT  is  responsive  to  all  -1553A  and  B  command- 
response  requirements.  When  designated  as  a  bus  controller,  the  BC/RT  initiates  and 
supervises  all  data  exchanges  over  the  dual  redundant  -1553  serial  data  bus.  Data 
storage  and  retrieval  at  the  host  parallel  data  bus  is  via  direct  memory  access. 

Features  include: 

a.  Packaged  on  a  single  card  module 

b.  Performs  as  a  Bus  Controller  and/or  Remote  Terminal  capable  of  executing 
-1553B  Mode  and  Illegal  Command  Word  Processing 

c.  Contains  separable  Word  Processing  and  Message  Processing/Microcontrol ler 
sections. 

d.  Word  Processing  section: 

•  Transparent  interface  for  -1553A  or  B  compatibility. 

•  Interfaces  with  dual  redundant  MUX  buses.  Performs  all  fast  response 

front-end  channel  functions,  including  word  validation,  and  command  and 
data  word  detect  and  decode. 

•  Provides  all  necessary  parallel  data  with  the  sense  and  control  signals 
required  by  the  Message  Processing/Microcontroller  section. 

e.  Message  Processing  Microcontroller  section: 

•  Transparent  architecture  for  interfacing  with  various  hosts  including 

those  with  microprocessors 

•  Programmable 

•  16-bit  bidirectional  data  bus 
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•  16-bit  address  bus 

•  DMA  capability  to  interface  with  host  microprocessor 

•  Provides  memory  protection  and  ability  for  indirect  addressing  of  host 
main  memory. 

Figure  5  is  a  block  diagram  showing  the  two  part  architecture  of  the  BC/RT  and  identi¬ 
fies  the  large  number  of  functions  which  are  packaged  on  the  single  card  in  less  than  50 
square  inches  by  the  optimum  utilization  of  LSI  technology. 

Communication  with  the  host  is  via  a  16-bit  bidirectional  data  bus.  A  16-bit  address  bus 
and  direct  memory  access  circuits  perform  the  functions  of  storage  and  retrieval  of  data 
to-and-from  host  memory.  Other  significant  circuit  elements  are  a  16-bit  terminal  bus 
for  fast  response  data  manipulation  and  transfer,  and  the  -1553  Status  Word  and  Last 
Command  Word  registers.  In  addition,  an  on-board  scratchpad  register  and  incrementer 
are  provided. 

Some  examples  of  the  application  of  digital  data  bus  technology  to  advanced  avionics  are 
the  U.S.  Army's  AN/ASQ-166  Integrated  Avionics  Control  System  (IACS)  and  the  AN/ASN-137 
Improved  LDNS. 

The  U.S.  Army  Avionics  Research  and  Development  Activity  (AVRADA)  developed  the 
AN/ASQ-166  IACS  which  is  characterized  by: 

1)  use  of  digital  data  bus  to  interconnect  sensors,  controls  and  displays 

2)  integration  of  programmable  controls  and  displays,  and 

3)  widespread  application  of  microprocessors  at  the  subsystem  level. 

The  AN/ASQ-166  IACS  provides  the  pilot  with  a  means  of  controlling  and  displaying 

communications,  navigation  such  as  the  AN/ASN-137,  and  identification  (CNI)  equipments 
with  a  single  integrated  control-indicator.  All  CNI  equipments  are  remotely  located  and 
their  information  is  transferred  by  a  dual-redundant  -1553  data  bus. 

The  basic  IACS  consists  of  five  units  -  two  control-indicators,  one  status  indicator  and 
two  interface  units.  Figure  6  shows  a  block  diagram  of  a  typical  IACS  installation.  The 
controlled  avionics,  shown  at  the  right  of  Figure  6  are  remotely  located  in  the  avionics 
bay  of  the  aircraft.  The  present  IACS  system  can  accommodate  up  to  ten  radios  and  asso¬ 
ciated  communications,  security  equipment  and  the  AN/ASN-137  Doppler  Navigation  Set. 

The  Primary  Control-Indicator  integrates  the  control  and  display  functions  of  all  ten 
CNI  and  associated  security  equipments  and  the  Doppler  Navigation  Radar.  This 

integration  is  accomplished  by  time-sharing  both  controls  and  displays  of  a  large  number 
of  previously  unrelated  systems.  Time-sharing  of  controls  and  displays  conserves  panel 
space  by  using  fewer  controls  and  displays  to  accomplish  the  necessary  avionics  control 
functions. 

The  Secondary  Control-Indicator  provides  a  minimum  capability  for  emergency  situations. 

The  U.S.  Army  has  embarked  on  a  development  program  to  extend  the  IACS  integration  con¬ 
cept  from  the  CNI  functions  to  the  remaining  cockpit  functions.  This  program  has  been 
designated  the  Army  Digital  Avionic  System  (ADAS).  IACS  is  a  subset  of  the  ADAS  system. 
Elements  of  ADAS  have  been  installed  in  a  UH-60A  Helicopter  Systems  Testbed  for  Avionics 
Research  (STAR)  and  are  undergoing  flight  test.  The  AN/ASN-137  is  one  of  the  avionic 

systems  included  in  the  ADAS  installation  in  STAR  along  with  the  IACS. 


Description  of  the  AN/ASN-137 

Another  example  of  the  use  of  advanced  digital  data  bus  technology  that  has  been 
developed  by  the  U.S.  Army  is  the  Singer-Kear fott  AN/ASN-137  Doppler  Navigation  System. 

Overall  design  of  the  AN/ASN-137  was  based  upon  two  requirements: 


provide  a  system  that  has  -1553  interface,  drives  a  Projected  Map  Display 
System  (PMDS)  and  can  operate  with  an  integrated  display  such  as  IACS,  and 


retain  as  much  of  the  AN/ASN-128  hardware  design  as  possible  to  minimize 
development  costs  and  to  have  maximum  commonality  with  the  AN/ASN-128  LRU's, 
SRU's,  and  logistics  support  equipment. 


The  changes  required  for  the  AN/ASN-137  to  meet  the  above  requirements  do  not  affect  the 
Doppler  radar  portion  of  the  AN/ASN-128.  Therefore  the  Receiver-Transmitter-Antenna 
(RTA)  and  a  major  portion  of  the  Signal  Data  Converter  (SDC)  need  not  be  changed. 
Avoiding  RTA  changes  simplifies  retrofit  of  the  AN/ASN-137  into  helicopters  already  con¬ 
taining  the  AN/ASN-128. 


The  need  to  provide  navigation,  guidance,  and  velocity  data  when  operating  with  an  inte¬ 
grated  display  such  as  IACS  instead  of  the  AN/ASN-128  CDU  required  the  computer  and 
memory  in  that  CDU  to  be  transferred  to  the  SDC. 
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A  simplified  CDU  was  developed  and  is  available  for  those  applications  of  the  AN/ASN-137 
where  IACS  is  not  provided.  A  major  design  feature  of  the  simplified  CDU  is  that  its 
operation  is  the  same  (except  for  PMDS  related  operations)  as  the  AN/ASN-128  CDU  to 
minimize  flight  crew  retraining  and  chance  of  confusion  when  flight  crews  operate 
different  helicopters. 

The  -1553  A  and  B  interface  was  added  to  the  expanded  SDC  to  provide  a  digital  communica¬ 
tion  capability  between  the  AN/ASN-137  and  other  avionics  in  the  helicopter.  Locating 
the  -1553  interface  in  the  expanded  SDC  was  also  desirable  since  its  design  would  be 
simplified  by  having  direct  access  to  the  computer  bus.  To  handle  the  increased  computa¬ 
tional  load  of  the  -1553  interface  and  other  avionics  (i.e.,  projected  map  drive  equa¬ 
tions,  offset  targeting,  etc.),  the  AN/ASN-128  program  memory  was  increased  from  8,000 
to  16,000  16-bit  words  while  still  providing  about  3000  words  of  spare  memory.  The 
Random  Access  Memory  was  increased  from  500  to  1000  16-bit  words  providing  about  200 
spare  words. 

To  provide  for  a  variety  of  on-board  sensors  and  displays,  a  "Program  Plug"  has  been 
added  to  the  outside  of  the  SDC.  Each  helicopter  designed  to  accept  the  AN/ASN-137  will 
have  a  captive  cable  that  connects  to  the  Program  Plug,  and  reprograms  the  interface 
within  the  AN/ASN-137  to  be  compatible  with  the  configuration  in  that  particular 
helicopter . 

A  block  diagram  of  the  overall  AN/ASN-137  system  is  shown  in  Figure  7.  Some  of  the  key 
system  features  are  listed  below: 

•  provide  -1553  two-way  multiplexed  bus  interface 

•  can  be  controlled  either  by  an  integrated  control/display  system  such  as  IACS, 
or  a  simplified  version  of  the  AN/ASN-128  CDU 

•  RTA  unchanged  for  ease  of  retrofit 

•  Program  plug  enables  operation  in  different  helicopter  avionics  configuration 
without  changes 

•  Drives  AN/ASN-99  Projected  Map  Display  System  (PMDS) 

A  photograph  of  the  RTA,  Simplified  CDU  and  Expanded  SDC  is  shown  in  Figure  8.  The 
Expanded  SDC  and  Simplified  CDU  have  the  same  installation  requirements  as  their 
AN/ASN-128  counterparts,  thereby  simplifying  retrofit.  Physical  characteristics  of  the 
AN/ASN-137  and  optional  SHIU  are  listed  in  the  table  below. 


AN/ASN-137 

WEIGHT 

VOLUME 

MTBF 

kg 

lb 

cm3 

in3 

(h) 

DRVS :  RTA 

4.76 

10.5 

7,752 

473 

12.0 

12,237 

SDC 

7.04 

15.5 

9,896 

603 

75.0 

3,723 

DRVS  Total: 

11.80 

26.0 

17,648 

1,076 

87.0 

2,855 

Simplified 

2.82 

6.2 

3,676 

224 

30.0 

4,584 

CDU 

TOTAL: 

14.62 

32.2 

21,324 

1,300 

21111111 

1,760 

SHIU 

0.91 

2.0 

1,067 

_ 

15.0 

10,000 

The  AN/ASN-137  completed  its  engineering  development  phase  in  late  1980,  and  was  inte¬ 
grated  by  Kearfott  with  the  AN/ASQ-166  IACS,  and  the  AN/ASN-99  Projected  Map  Display  in 
early  1981.  The  system  started  U.S.  Army  flight  test  in  mid-1981,  and  will  be  ready  for 
production  start-up  in  early  1982. 

SYSTEM  CONSIDERATIONS  FOR  HIGH  ACCURACY  APPLICATIONS 
Improved  Navigation  Accuracy 

Figure  9  shows  the  position  error  of  the  AN/ASN-128  or  AN/ASN-137  Doppler  Navigation 
Systems  when  a  typical  helicopter  magnetic  compass  is  used  to  provide  heading.  An  error 
of  one  degree,  (one-sigma),  is  characteristic  of  such  compasses,  resulting  in  a  CEP  of 
approximately  1.3%  of  distance  traveled.  For  this  system  configuration,  the  position 
error  after  50  kilometers  of  flight  is  650  meters,  as  shown  by  the  solid  line  in  the 
figure.  The  dotted  line  shows  the  error  build-up  when  an  improved  heading  reference, 
with  a  heading  error  of  0.5°  (one-sigma)  is  used.  This  accuracy  can  be  achieved  by  care¬ 
ful  compensation  of  magnetic  compass  deviation  error  and  by  data  stabilization  of  heli¬ 
copter  pitch  and  roll  effects  on  heading. 


The  increasing  performance  requirements  of  advanced  attack  and  scout  type  helicopters 
has  led  to  the  need  for  a  heading  reference  with  0.25°  (one-sigma)  accuracy  and  thus 
requires  the  use  of  a  new  system  approach. 
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The  SKH-3700  Attitude  Heading  And  Navigation  System  (AHANS) 

In  response  to  the  need  for  a  more  accurate  heading  reference  Kearfott  has  developed  the 
SKH-3700  AHANS.  The  AHANS  is  a  single-box  system  that  utilizes  strapdown  inertial  sensor 
technology  to  provide  very  accurate  heading,  attitude,  acceleration  and  angular  rate 
data  via  a  -1553  MUX  I/O.  The  AHANS  combines  velocity  data  from  the  AN/ASN-128  or 
AN/ASN-137  with  its  own  inertial  sensor  data  in  an  optimum  Kalman  filter  mechanization. 
The  combined  system  has  a  heading  accuracy  of  better  than  0.25°  (one-sigma). 

The  AHANS  consists  of  a  strapdown  inertial  sensor  block,  a  powerful  computer  (SKC-3121) 
programmed  in  a  High  Order  Language  (HOL) ,  I/O,  and  power  supply.  Two  two-degree-of- 
freedom  "dry"  CONEX*  gyros,  and  three  "dry"  pendulous  accelerometers  make  up  the  sensor 
block.  Figure  10  shows  a  block  diagram  of  the  AN/ASN-128  operation  with  the  AHANS. 
Figure  11  shows  the  AHANS  LRU,  typical  electronics  cards,  the  sensor  block,  the  gyro  and 
accelerometer . 

The  Kalman  filter  in  the  computer  software  is  a  24-state  mechanization.  It  models  both 
system  navigation  parameters  and  combined  Doppler/AHANS  component  error  sources. 
Through  the  optimum  combination  of  inertial  sensor  data,  Doppler  velocity  data,  and 
external  position  observations  (when  available),  the  AHANS  refines  estimates  of  vehicle 
position,  velocity,  and  attitude  during  flight  and  continually  calibrates 
Doppler/inertial  component  error  sources. 

This  mechanization  provides  a  rapid  reaction  "scramble"  or  in-flight  startup  capability 
so  important  in  military  operations,  without  impacting  navigation  accuracy  later  in  the 
flight.  In  addition,  improved  navigation  is  available  during  periods  of  backup  mode 
operation,  such  as  Doppler  in  memory. 

A  prototype  version  of  AHANS  is  currently  in  flight  test  by  the  U.S.  Army,  where  it  is 
operating  with  an  AN/ASN-128.  Navigation  results  have  been  excellent,  with  position 
errors  less  than  400  meters  after  2  hours  of  flight.  Heading  errors  have  averaged  less 
than  0.25°  (one-sigma)  during  this  time. 

The  AHANS  with  its  powerful  digital  computational  capability  when  interfaced  via  a  -1553 
MUX  bus  with  the  Doppler,  and  controlled  by  XACS  will  provide  not  only  navigation  but 
also  velocity,  heading,  attitude,  acceleration  and  angular  rates  with  the  accuracies 
needed  for  future  requirements. 

Externally  Referenced  Systems 

Another  level  of  system  performance  improvement  and  operational  capability  can  be 
obtained  by  combining  the  AN/ASN-128  or  the  AN/ASN-137  with  externally-referenced 
systems  such  as  the  Global  Positioning  System  (GPS),  Position  Location  and  Reporting 
System  (PLRS)  or  the  Joint  Tactical  Informatioi  Distribution  System  (JTIDS) .  As  was 
shown  in  Figure  9,  the  position  error  of  a  Doppler  radar  navigation  system  increases  with 
distance  traveled.  The  position  error  of  an  externally-referenced  system  is  essentially 
bounded  and  predictable.  A  combined  Doppler/position  sensing  system  has  several  impor¬ 
tant  advantages:  The  position  error  is  bounded  to  that  of  the  position  sensing  system, 
errors  in  the  Doppler  navigation  data  (velocity  and  heading)  are  calibrated  by  the 
position  sensing  system,  and  finally,  accurate  navigation  and  guidance  data  continue  to 
be  available  to  the  flight  crew  even  when  operation  of  the  position  sensing  system  is 
interrupted  for  any  reason  including  intentional  interdiction  by  the  enemy.  As  future 
position  sensing  systems  become  mature,  one  can  expect  increased  interest  in  combining 
these  systems  to  obtain  more  optimum  navigational  accuracy  and  reliability. 

TECHNOLOGY  ADVANCES  TO  MEET  NEW  REQUIREMENTS 

As  electronic  components  decrease  in  size,  weight  and  power  requirements,  the  demands 
for  increased  capability  and  functions  tend  to  increase  to  fill  the  available  space 
created.  For  example,  the  Doppler  radar  echo  contains  altitude  (distance  above  the 
ground)  information  in  the  phase  of  its  modulation.  As  microprocessor  and  VLSI  tech¬ 
nology  develops,  it  will  be  possible  and  desirable  to  add  an  altimeter  function  to  the 
Doppler  navigation  radar  basically  without  penalty. 

CRT  displays,  when  used  in  combination  with  microprocessors,  are  providing  new  versati¬ 
lity  in  the  amount,  format  and  quality  of  the  information  which  can  be  provided  to  the 
pilot.  The  use  of  multi-color  CRT's  adds  the  dimension  of  color  to  the  data,  allowing 
highlighting  of  critical  data  on  the  CRT  face.  The  advent  of  flat  panel  displays  will 
save  volume,  weight  and  power  over  current  CRT's. 

The  increase  in  memory  capacity,  which  Magnetic  Bubble  Memories  and  VLSI  offer,  will 
allow  digital  map  storage  which  can  be  displayed  on  a  CRT  or  flat  panel  together  with 
position,  track-made-good,  and  track-to-go  superimposed  from  the  onboard  navigation 
system. 

As  mentioned  above,  the  progress  in  circuit  miniaturization  will  produce  major  changes 
in  the  size,  weight,  power  consumption  and  capabilities  of  avionic  hardware.  Micro¬ 
processors  are  being  used  in  almost  all  signal  processing  applications,  replacing  bulky 
analog  devices  such  as  filters  and  inductors.  Discrete  microwave  circuits  using  wave¬ 
guide  interconnections  are  being  replaced  by  printed  circuit  equivalents  (called 
"Stripline"  or  "Microstrip"),  with  integrated  active  devices  embedded  in  the  printed 
circuitry. 

*  Trademark  of  The  Singer  Company. 
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Kearfott  has  been  in  the  forefront  in  applying  these  technologies  to  its  product  lines, 
especially  on  printed  microstrip  antennas.  A  printed  microstrip  Doppler  radar  antenna 
is  being  developed  to  replace  the  AN/ASN-128  printed  grid  antenna.  It  is  only  0.030 
inches  (0.8  mm)  thick  and  can  be  applied  to  conform  to  an  aircraft  surface.  This  new 
version  weighs  2  lb  less  and  requires  only  40%  of  the  present  volume. 

Figure  12  graphically  illustrates  the  benfits  of  technological  breakthroughs  to  avionic 
systems.  The  criterion  used  here  was  the  weight  of  Doppler  navigation  radar  systems 
produced  since  1950.  The  dramatic  decrease  in  weight  between  1950  and  1960  is  primarily 
due  to  replacing  vacuum  tubes  with  transistors.  Between  1960  and  1970  the  weight 
decreases  were  accomplished  by  improvements  in  antenna  technology,  resulting  in  smaller 
antennas  and  much  simpler  antenna  stabilizing  gimbals.  In  addition,  improvements  in  RF 
hardware  permitted  the  replacement  of  pulsed  high  power  transmitters  by  more  efficient 
solid  state  sources  using  FM-CW  modulation  techniques.  Since  1970,  further  weight 
reductions  were  achieved  by  replacing  mechanical  antenna  stabilization  with  digital  data 
stabilization,  replacing  slotted  waveguide  antennas  with  printed  antennas,  and  by  the 
extensive  use  of  digital  logic  and  MSI/LSI  components.  Each  reduction  in  weight  was 
accompanied  by  a  reduction  in  cost  and  size. 

The  current  rapid  pace  of  developments  in  VLSI,  microprocessors,  microwave  integrated 
circuits  and  advanced  digital  signal  processing  techniques  will  afford  opportunites  for 
even  greater  degrees  of  avionic  sensor  integration. 

By  virtue  of  these  cost  and  size  reductions,  we  will  see  operational  capabilities 
currently  supplied  in  sophisticated  fixed  wing  aircraft,  extended  to  future  helicopters 
and  drones. 
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DESIGN  FOR  MAINTAINABILITY  AND  PLAN  FOR  MAINTENANCE 
by 

James  "Roy"  Callaghan 
Chief,  Production  Resources  Division  (MAW) 
Aerospace  Guidance  &  Metrology  Center  (AGMC) 
Newark  Air  Force  Station 
Newark,  OH  43055,  U.S.A. 


SUMMARY 


The  purpose  of  this  paper  Is  to  Increase  the  awareness  and  emphasize  the  need  to: 

(1)  Consider  maintainability  of  systems/equipment  in  the  design  phase  of  the  hardware. 

(2)  Do  In-depth  planning  for  the  actual  maintenance  effort  commencing  very  early  In  the  weapon 
system  programs. 

Maintainability  and  maintenance  planning  must  get  more  attention  during  a  system’s  life  cycle  (the 
earlier,  the  better).  There  Is  evidence  that  often  In  the  past  the  pressure  of  other  factors  such  as 
operational  requirements,  reliability  considerations,  budget,  and  schedule  have  overshadowed  adequate 
maintainability  and  maintenance  considerations. 

This  paper  presents  the  reasons  for  early  and  adequate  attention  to  maintenance  factors  and  conversely 
the  penalties  for  not  providing  them  adequate  attention. 

The  U.S.  Department  of  Defense  Directive  No.  5000.40,  Reliability  and  Maintainability,  will  be  briefly 
discussed. 

Maintenance  concepts,  specific  maintainability  design  considerations  and  maintenance  planning  elements 
will  be  outlined  and  some  lessons  learned  will  be  presented. 


INTRODUCTION 


Reliability  and  Maintainability  (RAM)  are  the  two  major  factors  that  determine  the  availability  of 
equipment.  When  equipment  costs  were  much  lower  and  when  there  were  adequate  maintenance  resources 
(trained  technicians,  parts  availability,  etc),  lack  of  availability  due  to  low  reliability  or  poor  main¬ 
tainability  was  simply  overcome  by  buying  more  hardware. 

A  recent  report  by  the  U.S.  congressional  watchdog  agency,  the  U.S.  General  Accounting  Office  (GAO), 
stated  that  "as  much  as  90  percent  of  the  total  cost  of  a  weapon  system  are  ownership  (supply  and  mainten¬ 
ance)  costs  and  only  10  percent  are  acquisition  costs:  (Reference  A).  The  U.S.  Air  Force  spends  one  third 
of  Its  budget  on  maintenance.  (Reference  C,  p.  IV- 1 ) .  Maintainability  is  a  result  of  design;  therefore. 

It  just  makes  sense  to  stress  maintainability  In  this  design  process.  Vice  Admiral  E.R.  Lemour,  Chief  of 
the  U.S.  Naval  Air  Systems  Command  even  goes  so  far  as  saying  that  if  a  system  Is  to  have  a  life  cycle  of 
20  years  or  more,  maintainability  should  take  precedence  over  reliability  as  the  prime  design  factor. 
(Reference  D,  p.  60). 

Reliability  and  maintainability  must  be  considered  together  because  one  can  usually  be  Improved  but 
often  only  at  the  expense  of  the  other. 

Some  of  the  reasons  that  maintenance/maintainability  have  not  In  the  past  been  given  their  deserved 
share  of  attention  are: 

(1)  Early  emphasis  on  maintainability  through  design  requires  up-front  money.  With  shortage  of 
defense  funds,  money  has  often  not  been  available  In  the  early  part  of  programs.  This  is  an  obvious  reason 
that  a  program  should  be  planned  around  a  life-cycle  cost  concept.  If  the  life  cycle  cost  concept  had  been 
rigidly  applied,  more  funds  would  have  been  applied  to  maintainability  early  In  the  programs  to  save  funds 
In  later  years. 

(2)  The  most  visible  sign  of  accomplishment  of  a  program  office  Is  when  It  gets  It's  bright  new 
shining  airplane  on  the  runway.  The  next  most  Important  evidence  of  accomplishment  Is  the  declaration  that 
the  weapon  system  Is  mission  capable.  There  has  been  no  event  where  someone  has  had  to  stand  up  and  tell 
the  world  that  the  weapon  system  Is  maintainable. 

(3)  Program  Managers  and  designers  are  responsible  for  a  program  usually  for  only  a  few  years  of 
its  total  life  cycle.  Would  they  possibly  not  do  things  differently  If  they  knew  they  were  going  to  be 
responsible  for  the  supportablllty  of  the  system  for  their  total  career  or  life  of  the  system. 

POP  DIRECTIVE  5000.40  "RELIABILITY  AND  MAINTAINABILITY11,  JULY  6,  I960 

To  Improve  operational  effectiveness  and  to  reduce  cost  of  ownership  through  improved  supportablllty 
of  weapon  systems,  the  U.S.  Department  of  Defense  Issued  this  directive  to  the  U.S.  Military  Departments  and 
the  defense  agencies.  It  states  these  objectives  for  reliability  and  RAM  maintainability  activities: 

(1)  Increase  operational  readiness  and  mission  success. 
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(2)  Reduce  ownership  cost  through  reduced  maintenance  and  logistic  support  requirements. 

(3)  Limit  manpower  needs  for  operation  and  maintenance. 

(4)  Provide  R&M  management  data. 

(5)  Ensure  cost  effectiveness  of  R&M  Investment. 

The  directive  requires  that  R&M  be  addressed  at  each  major  milestone  In  the  system  acquisition  process. 
Projected  deficiencies  of  operational  readiness,  mission  success,  maintenance  manning,  and  logistic  support 
must  be  addressed.  Another  Important  provision  of  this  directive  Is  that  follow-on  buys  of  additional 
hardware  and  spares  as  well  as  modifications  will  be  to  the  same  specifications  as  the  original  equipment. 

The  reaction  to  this  directive  by  Gen  Bryce  Poe,  II,  the  recently  retired  commander  of  the  U.S.  Air 
Force  Logistics  Command,  was:  “The  raising  up  of  these  (reliabillty/maintalnabillty)  to  equal  level  of 
emphasis  with  schedule  and  performance  is  long  overdue."  (Reference  8). 

PAYOFF  OF  EFFECTIVE  MAINTENANCE 

A  $25  million  aircraft  is  not  much  of  a  threat  to  a  potential  enemy  if  it  is  not  mission  capable. 

A  plane  can  be  rendered  not  mission  capable  during  the  time  required  for  its  maintenance  or  during  the 
time  it  Is  awaiting  a  serviceable  subsystem  or  component  to  be  retained  from  the  repair  activity.  There 
is  just  not  enough  money  In  the  world  to  buy  "spare"  airplanes  to  compensate  for  a  high  non  commission 
rate. 

A  typical  inertial  measurement  unit  can  easily  cost  $100,000  to  $500,000.  Assume  a  depot  repair 
requirement  of  60  units  per  month  and  a  total  repair  pipeline  time  of  30  days  including  transportation. 

Based  on  an  arbitrary  average  value  of  $200,000  per  unit,  a  reduction  of  the  need  to  evacuate  10%  of  the 
failed  units  to  the  depot  could  save  $1.2  million  in  pipeline  spares  costs  recurring  costs  of  approximately 
$36,000  per  month  in  depot  repair  costs.  If  the  pipeline  time  of  the  remaining  54  units  per  month  requiring 
repair  could  then  be  reduced  by  five  days,  an  additional  $2.0  million  in  pipeline  spares  costs  could  be 
saved. 

Let's  continue  with  this  example.  Assume  that  a  portion  of  the  reduction  of  the  pipeline  time  was  due 
to  easier  maintenance  at  the  depot  because  of  more  maintainable  hardware  and  to  better  diagnostic  techniques 
and  test  procedures.  A  10%  reduction  of  depot  labor  and  repair  parts  could  save  $600  per  unit,  or 
$32,400  per  month.  Better  diagnostic  and  test  procedures  could  save  10%  of  depot  equipment  costs  or  approxi¬ 
mately  another  million  dollars. 


Summary  of  above  cost  savings  based  on  20-year  program: 

Reduced  reparables  (60  to  54  units) 

Reduced  pipeline  (30  to  24  days) 

Reduced  manpower  &  parts 
Reduced  support  equipment 

Sub  Totals 

TOTAL  $20.61  Million 


One  Time 
$1.20  Mil 


Recurring 


$8.64  Mil 


$4.20  Mil  $16.41  Mil 


NOTE:  This  is  a  potential  savings  for  only  one  of  the  many  avionics  boxes  on  an  aircraft. 
MAINTENANCE  CONCEPT 

The  maintenance  concept  must  outline  to  what  depth  repair  is  to  be  accomplished  at  which  level  by  the 
techniques  which  can  be  accomplished  with  the  skills  expected  to  be  available  at  each  level. 

(1)  Projected  level  and  locations  of  maintenance.  There  are  a  lot  of  trade  offs  which  must  be 
made  to  determine  where  various  maintenance  tasks  should  be  done.  Traditionally  we  have  had  three  levels 
of  maintenance  (organizational  or  flight  line,  intermediate  or  base  level,  and  depot  level).  There  are 
some  proponents  for  elimination  of  the  Intermediate  level  shop  due  to  problems  with  support  equipment  and 
retaining  skilled  technicians.  If  the  intermediate  shop  is  eliminated,  we'll  have  to  change  our  complete 
concept  of  spares  and  parts  support. 

Generally,  depot  level  support  should  be  planned  to  be  done  in  military  repair  depots. 

This  is  normally  more  cost  effective  as  well  as  better  assures  response  if  there  is  a  surge  in  requirements. 
Interservice  and  foreign  military  sales  support  should  not  be  overlooked. 

Interim  contract  support  using  contractor  excess  production  capability  in  the  early  phases 
of  a  program  can  be  advantageous.  It  should  be  planned  for  early  in  the  program.  There  is  always  the 
danger  of  contractors  being  more  concerned  about  his  new  production  rather  than  his  repair  commitments. 

The  assumption  that  a  manufacturer's  new  build  capability  can  be  copied  for  depot  level 
repair  is  false.  New  build  and  repair  are  not  the  same.  Depot  repair  normally  requires  a  more  extensive 
capability  than  new  repair  such  as  more  In  depth  diagnostic  capability.  Depot  requirements  can  however 
usually  be  satisfied  by  supplementing  and  adapting  the  manufacturer's  equipment  and  methods. 


20-3 


(2)  Fault  Isolation  and  System  Testing  Approach: 

As  avionics  become  more  complex  and  as  It  becomes  more  difficult  to  train  and  retain  skilled 
maintenance  technicians,  Built-In  Test  (BIT)  capability  Is  becommlng  more  desirable.  This  Is  particularly 
advantageous  for  flight  line  and  Intermediate  level  maintenance. 

Automatic  Test  Equipment  (ATE)  Is  normally  advantageous  for  testing  of  large  volume  complex 

avionics. 


To  compensate  for  slight  test  equipment  Incompatibilities  and  to  assure  a  useful  product  Is 
provided  to  the  user,  a  pyramid  of  tolerances  must  be  established.  This  pyramid  allows  test  result 
tolerances  which  are  less  forgiving  at  intermediate  level  than  at  flight  line  level  and  less  forgiving  at 
depot  level  than  at  intermediate  level. 

(3)  Equipment  Maintenance  Approach: 

Equipment  Is  maintained  through  either  repair  when  broken  and/or  preventive  maintenance. 
Avionics  maintenance  usually  relies  on  repair  and  then  only  repair  on-condition,  l.e.,  repair  or  replace 
only  the  component  which  exhibited  a  failure. 

The  key  to  cost  effectiveness  maintenance  Is  to  plan  the  proper  maintenance  approach  at  the 
proper  level  of  maintenance. 

(4)  Maintenance  Demonstration  and  Verification  Tests: 

In  the  past,  schedules  often  did  not  allow  for  an  adequate  maintainability  demonstration  and 
if  they  Included  only  enough  time  for  those  which  were  success  oriented,  i.e.,  no  time  was  permitted  for 
corrective  action. 

To  be  effective,  this  demonstration  and  verification  must  be  done  using  maintenance  technicians 
of  the  skill  level  expected  to  be  available  to  perform  the  actual  maintenance  tasks  and  if  possible  in  the 
actual  maintenance  environment. 

PLANNING  EFFORT  MUST  ADDRESS  THE  FOLLOWING  RESOURCES  AND  CONSIDERATIONS 

(1)  Support  Equipment  (SE): 

Support  equipment  usually  represents  a  major  expense  especially  if  automated  test  equipment 
(ATE)  Is  used.  The  ATE  associated  software  often  costs  more  than  the  equipment  itself.  A  software  support 
capability  (for  changes/updates)  must  be  developed  and  retained  throughout  the  life  of  the  program.  Care 
must  be  taken  not  to  over-automate  due  to  these  costly  factors. 

The  SE  must  receive  the  same  level  of  attention  relative  to  its  design  and  ability  to  be 
supported  throughout  the  life  of  the  program  as  the  airborne  hardware. 

(2)  Supply  Support: 

Good  supply  support  requires  a  good  prediction  of  the  requirements  and  timely  procurement. 
Availability  of  parts  then  is  based  on  timely  receipt  of  parts  which  meet  specifications. 

Prediction  of  parts  requirements  and  future  verification  and  correction  have  all  too  often 
been  based  upon  failure  modes  experienced  during  system  manufacture  which  is  not  necessarily  that  which 
can  be  expected  during  the  operational  phase.  Logistics  and  maintenance  technician  can  normally  better 
predict  parts  requirements  based  on  similar  In-service  hardware. 

Timely  procurement  can  be  a  problem,  particularly  with  increased  lead  times.  Care  must  be 
taken  to  assure  parts  being  procurred  are  of  the  configuration  to  be  included  In  the  final  design. 

Lead  times  for  parts  continue  to  rise.  This  is  due  to  causes  such  as  lack  of  adequate 
manufacturing  capacity  (skilled  manpower  and  equipment  availability)  and  limited  critical  materials 
availability. 

(3)  Transportation  and  Handling: 

We'll  never  know  how  much  damage  to  inertial  navigation/guidance  equipment  is  caused  by 
handling  and  during  transportation.  We  do  know  that  inertial  components  are  extremely  sensitive  to 
physical  damage.  Logic  must  tell  us  that  every  reasonable  action  should  be  taken  to  minimize  this  possi¬ 
bility  of  damage. 

This  must  be  taken  Into  consideration  during  design  of  the  airborne  equipment  itself  and  its 
shipping  container.  It  also  requires  that  all  who  handle  this  equipment,  both  in  the  shipping  container 
and  outside  it,  are  acquainted  with  its  delicacy  and  are  trained  in  proper  handling. 

Equipment  being  transported  is  not  available  for  use.  Spares  must  be  bought  to  fill  this 
transportation  pipeline.  It  therefore  behoves  us  to  plan  the  transportation  cycle  between  user  and  the 
repair  sites  to  take  minimal  time. 

(4)  Technical  Data: 

Technical  data  is  another  expensive  resource  required  for  maintenance.  Care  must  be  taken 
to  assure  that  the  data  is  written  to  the  expected  skill  level  of  the  maintenance  technicians.  It  is  said 
that  often  it  Is  at  too  high  a  level  because  it  is  written  by  graduate  engineers  for  lesser  educated  workers. 
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The  most  neglected  phase  of  technical  data  development  is  the  verification  of  that  data  by 

maintenance  personnel  In  the  actual  environment  In  which  It  Is  to  be  used.  This  must  be  done  in  sufficient 

time  to  allow  corrections  and  changes  to  be  Incorporated  In  the  data  prior  to  Its  need. 

(5)  Facilities: 

The  maintenance  concept  should  be  so  that  there  are  relatively  little  peculiar  facility 
requirements  at  other  than  at  the  repair  depot  level. 

Peculiar  facility  for  maintenance  requirements  have  to  be  identified  very  early  In  the 
program  due  to  the  long  lead  time  for  design  and  construction  and  in  some  cases  physical  stabilization. 

(6)  Personnel  and  Training: 

The  complexity  of  the  equipment  continues  to  Increase;  however,  the  quality  of  the  manpower 

required  to  maintain  that  equipment  Is  not  increasing.  It  becomes  more  difficult  and  lengthy  to  train  and 

develop  skills  in  personnel.  When  these  skills  are  developed,  it  Is  difficult  to  retain  these  people 
because  they  become  attracted  to  the  non  military  job  market. 

Not  only  must  maintenance  training  be  planned  for  the  Initial  weapon  system  activation,  but 
follow-on  training  must  be  planned  to  retain  an  adequate  number  of  trained  personnel  to  compensate  for 
attrition. 


Although  usually  expensive,  the  use  of  Contractor  Engineering  Technical  Services  (CETS) 
should  be  considered  to  assist  the  maintenance  personnel  in  becoming  proficient  in  the  early  part  of  a 
program. 


(7)  Management  Data: 

Collection  and  analysis  of  management  data  must  be  a  planned  activity. 

Early  In  a  program,  decisions  are  based  upon  management  data  furnished  by  the  contractors 
and  management  data  collected  from  similar  in-service  systems. 

Good  management  data  permits  us  to  accurately  determine  how  we  are  doing  against  established 
goals  and  milestones  as  well  as  provide  a  baseline  to  measure  modifications  or  program  changes. 

(8)  Safety: 

All  maintenance  tasks  must  be  analyzed  relative  to  safety  to  both  the  maintenance  technicians 
and  the  hardware  being  maintained. 

Solvents  specified  for  cleaning  should  only  be  those  which  are  not  suspected  carcinogens. 

Of  current  concern  is  the  large  amount  of  damage  to  delicate  electronic  components  from 
static  electricity.  This  problem  has  the  potential  to  get  bigger  as  the  newer  technology  electronics  come 
Into  use. 


(9)  Security: 

Security  must  be  consciously  considered  In  maintenance  planning  as  well  as  in  operational 
planning.  Provisions  have  to  be  made  to  safeguard  classified  hardware  and  data  throughout  the  maintenance 
cycle. 


(10)  Environmental  Considerations: 

Governments  and  the  public  are  becoming  more  sensitive  to  the  quality  of  the  environment. 
Recently,  environmentalists  have  expressed  concern  that  freon  is  destroying  the  ozone  layer  of  the  earth's 
atmosphere.  Freon  Is  used  In  large  quantities  for  cleaning  inertial  Instruments  parts.  Some  of  this  freon 
Is  not  recaptured  after  use  and  therefore  does  escape  Into  the  atmosphere. 

In  maintenance  planning,  we  must  be  alert  to  other  similar  situations  whereby  the  discharge 
or  residue  of  harmful  materials  should  be  controlled  or  alternate  methods  or  material  should  be  used. 

DESIGN  CONSIDERATIONS 


Design  considerations  which  Impact  the  Maintenance  Concept  and  Maintainability:  Design  trade-offs 
must  be  made  to  optimize  performance,  weight-size,  cost,  schedule,  reliability,  and  maintainability. 
Remember,  the  unit  must  be  maintained/repaired  many  times  and  for  many  years  after  the  other  design  consid¬ 
erations  are  usually  forgotten. 

(1)  Packaging  of  the  GSC  (Guidance  and  Control),  (Single  Package  vs  Multiple  Packaging): 

Packaging  has  a  great  bearing  on  the  maintenance  concept  and  the  number  and  cost  of  pipeline 
spares  G&C  units  or  sub  units  which  must  be  procured.  Packaging  as  much  as  possible  In  a  single  housing 
saves  handling  of  several  different  units  and  assures  compatibility  of  subassemblies  contained  In  the  single 
package,  l.e. ,  they  can  be  married  at  manufacture  and  subsequently  at  the  repair  depot.  On  the  other  hand, 
when  one  subassembly  falls.  It  could  mean  returning  the  whole  unit  to  the  repair  depot,  depending  on  the 
maintenance  concept  and  spares  provisioning.  If  each  subassembly  were  contained  in  separate  packages(black 
boxes)  then  only  the  failed  subassembly  need  be  removed  from  the  aircraft  and  sent  for  maintenance. 
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Weight  and  size  of  the  airborne  equipment  are  other  factors  which  help  dictate  packaging. 

As  more  females  enter  the  maintenance  workforce,  we  may  need  to  reevaluate  some  human  engineering  factors 
which  were  developed  based  on  average  male  physical  characteristics. 

(2)  Accessibility  of  the  G&C  System  on  the  Aircraft: 

On  one  of  our  major  aircraft,  the  pilots  seat  must  be  removed  to  obtain  access  to  the 
inertial  platform.  High  failure  Items  should  be  placed  where  they  can  easily  be  removed  and  replaced. 
UnHs  should  be  placed  so  that  indicators  or  connections  used  for  checkout  or  serviceing  in  place  are 
readily  accessible. 

(3)  Electronic  Circuit  Accessibility: 

Fault  Isolation  of  electronics  provide  some  special  problems  to  the  maintenance  technician. 
Some  of  the  problems  which  should  be  considered  by  the  designers  are: 

(a)  Test  point  accessibility  external  to  the  black  box. 

(b)  Ability  to  isolate  to  a  single  faulty  electronic  module  or  part. 

(c)  Circuit  tuning  should  be  able  to  be  accomplished  by  adjustable  components  rather  than 
through  hard  wired  components. 

(4)  Accessibility  of  parts  within  the  system. 

Parts  subject  to  high  failure  should  physically  be  located  where  they  can  be  replaced 
without  extensive  disassembly  or  removal  of  numerous  other  parts. 

Frequently  removed  electronic  parts  or  electronic  modules  should  be  mated  using  connectors 
rather  than  hardwiring.  (These  should  be  permanently  keyed  to  preclude  damage  caused  by  an  electronic 
module  being  able  to  be  installed  in  the  wrong  slot). 

(5)  Standardization: 

Standardization  should  be  considered  starting  with  the  avionics  system  itself.  It  should 
subsequently  be  considered  through  each  indenture  of  hardware  down  to  the  last  bit  and  piece. 

Advantages  of  standardization  are: 

(a)  Maintenance  time  reduced  due  to  maintenance  technicians  experience  being  applied  to 
reduced  span  of  hardware. 

(b)  Less  range  of  parts  required  to  be  purchased  and  managed. 

(c)  Higher  probability  of  part  being  available. 

A  recent  U.S.  GAO  report  shows  that  on  a  (non  U.S.A.F.)  program,  2000  varieties  of  parts  were  procurred 
that  differed  very  little  from  parts  already  In  stock.  (Reference  A) 

CONCLUSIONS 


Program  Managers  and  designers  should  take  advantage  of  the  vast  amount  of  maintenance  expertise 
that  exists  in  the  using  commands,  in  the  various  logistics  support  offices,  and  at  the  responsible  main¬ 
tenance  depots.  They  should  be  consulted  early  In  the  design  phase  as  well  as  invited  to  participate  in 
the  various  design  reviews  normally  held  during  an  equipment  program.  This  should  apply  not  only  to 
airborne  hardware  design  but  also  to  support  equipment  design. 

Our  challenges  however,  are  not  only  to  apply  the  lessons  learned  from  past  experience  but  to 
anticipate  the  effects  of  ever  changing  technology  and  other  influences  on  supportability  of  a  weapon 
system  through  its  life  cycle,  such  as  the  Increased  lead  time  for  parts  procurement  and  the  Increased 
inability  to  retain  skilled  maintenance  technicians.  Weapon  systems  and  their  subsystems  become  more 
complex  and  due  to  technology  improvements  become  obsolete  sooner  however,  due  to  their  replacement  cost 
are  expected  to  be  used  and  supported  longer. 

In  short,  we  must  make  more  complex  equipment  more  maintainable  by  fewer  skilled  people,  using  less 
costly  support  equipment,  less  parts,  for  a  longer  period  of  time.  This  can  be  done  only  through  good 
maintainability  design  and  good  maintenance  planning. 
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DEFINITIONS:  (From  U.S.  Dept  of  Defense  MIL-STD-721B) 

ACCESSIBILITY:  A  measure  of  the  relative  ease  of  admission  to  the  various  areas  of  an  Item. 

AVAILABILITY:  A  measure  of  the  degree  to  which  an  Item  Is  In  the  operable  and  commlttable  state  at  the 
start  of  the  mission,  when  the  mission  Is  called  for  at  an  unknown  (random)  point  In  time. 

CAPABILITY:  A  measure  of  the  ability  of  an  Item  to  achieve  mission  objectives  given  the  conditions  during 
the  mission. 

MAINTAINABILITY:  A  characteristic  of  design  and  Installation  which  Is  expressed  as  the  probability  that 
an  Item  will  be  retained  In  or  restored  to  a  specific  condition  within  a  given  period  of  time,  when  the 
maintenance  Is  performed  In  accordance  with  prescribed  procedures  and  resources. 

MAINTENANCE:  All  actions  necessary  for  retaining  an  Item  in  or  restoring  It  to  a  specified  condition. 

RELIABILITY:  The  probability  that  an  Item  will  perform  Its  Intended  function  for  a  specified  interval 
under  stated  conditions. 
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SUMMARY 

This  paper  covers  the  testing  of  equipment  for  highly  integrated  guidance  and 
control  systems.  Specifically,  it  looks  at  a  departure  to  the  usual  acceptance  testing 
by  examining  in  some  detail  a  technique  called  production  verification  testing--or  PVT. 
First,  the  paper  reviews  some  of  the  recent  literature  and  experience.  Further,  the 
paper  through  computer  simulations,  examines  various  facets  of  PVT.  Particular  emphasis 
is  directed  toward  the  implication  of  100%  testing  of  all  systems  prior  to  delivery 
through  the  use  of  'N'  sequential  failure-free  cycles.  Failure  is  defined  as  a  relevant 
or  non-relevant  occurrence  which  precludes  continuation  of  testing.  Finally,  the  paper 
presents  some  conclusions  drawn  from  computer  simulations.  For  example,  it  suggests  the 
number  of  'N'  sequential  failure  free  cycles  that  may  be  necessary.  It  provides  insight 
into  interpreting  the  results.  Simulation  results  suggest  a  means  for  determining  not 
only  expected  operational  reliability  but  also  process  control  problems  during  manu¬ 
facturing. 


LIST  OF  SYMBOLS 

Constant  Determined  by  Circumstances 
Total  Hours 
Line  Replaceable  Unit 
Mean  Time  Between  Failure 
Total  Mission  Time  Per  Year 
Number  of  Turn-on/Off  Cycles 
Growth  Rate 

Failure  Rate  Due  to  Calendar  Time  (Aging) 
Predicted  Failure  Rate 
Failure  Rate  Due  to  Turn-on/Off  Cycles 
Total  Failure  Rate 
Cummulative  Failure  Rate 

Production  Reliability  Verification  Testing 
Production  Verification  Testing 
Nautical  Miles  Per  Hour 


The  underlying  reason  for  this  paper  is  to  present  an  analysis  of  production 
verification  testing  (PVT).  The  author's  interest  in  the  subject  goes  back  a  dozen 
years.  Initial  exposure  to  the  technique  was  through  the  observation  of  its  implementa¬ 
tion  to  a  major  program.  rt  was  then  called  production  reliability  verification  testing 
or  PRVT.  The  results,  compared  to  the  usual  burn-in  tests  can  best  be  termed  dramatic. 

Reliability  of  delivered  equipment  was  significantly  improved.  The  technique  was  neither 
widely  understood  nor  used.  Somewhat  later  a  program  was  having  difficulty  passing 
reliability  testing  and  delivering  either  failed  or  low  mean  time  between  failure  (MTBF) 
systems.  Remembering  the  results  of  PRVT  we  convinced  management  to  institute  a  similar 
procedure.  Again,  there  was  dramatic  improvement  in  fielded  reliability.  Flush  with  the 
taste  of  success,  we  were  able  to  convince  more  program  managers  of  guidance  ar.d  control 
systems  that  they  should  be  using  this  technique  as  a  planned  effort  in  the  beginning 
rather  than  well  into  a  contracted  effort  when  deliveries  were  underway.  Throughout  the 
time  period  and  up  to  the  present  we  were  perplexed.  We  knew  that  when  we  used  this 
technique,  reliability  of  fielded  systems  was  higher  than  when  PRVT  was  not  used.  The 
problem  was  we  did  not  know  how  much  testing  we  needed.  Worse  yet,  the  relationship 
between  testing  and  fielded  reliability  was  not  quantifiable.  It  was  for  that  reason 
that  later  efforts  in  this  area  were  called  PVT.  The  intent  was  to  avoid  the  impression 
that  PRVT  was  a  replacement  for  reliability  testing.  With  the  wider  use  of  PVT,  both 
in  the  military  and  commercial  marketplace,  it  was  deemed  appropriate  to  attempt  an 
analysis  of  the  method. 
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1.  INTRODUCTION 

Use  of  guidance  and  control  technology  for  highly  integrated  systems — the  theme  of 
this  conference — i s  determined  in  the  final  analysis  by  operational  requirements. 
Clearly,  one  facet  of  this  is  performance.  If  a  0.5  NM/HR  inertial  navigation  set  is 
needed  as  part  of  a  weapon  delivery  system,  then  providing  one  that  performs  at  2.0 
NM/HR  yields  limited  utility  n.  matter  how  reliable  it  is.  The  converse  is  equally 
important.  A  highly  accurate  inertial  system  provides  little  utility  to  the  user  if  it 
does  not  work.  In  autonomous  integrated  systems  flying  at  low  level — the  price  of  low 
reliability  is  deadly  if  not  expensive.  Redundancy  is  the  mathematician's  trick  for 
raising  the  probability  of  success.  The  result  is  a  nightmare  for  the  logisticians  as 
well  as  those  trying  to  balance  a  budget.  The  tradeoff  between  life  cycle  cost  and 
operational  readiness  is  ever  present.  If  you  will--the  very  topic  of  this  session — 
affordability  and  survivability  hinges  on  acquiring  reliable  equipment  with  confidence 
and  at  minimum  expense.  It  should,  however,  be  pointed  out  that  this  paper  does  not 
address  or  suggest  changes  to  Defense  Department  directive  or  any  service  policies  and 
specifications. 


2.  BACKGROUND 

Acquiring  reliable  equipment  is  certainly  no  easy  task  as  evidenced  by  the  literature. 
Selby  and  Miller  state  that  a  reliability  "...credibility  gap  exists  between  stated 
equipment  reliability  requirements  and  realized  or  realizable  achievement."  (1)  They 
go  on  to  say  that  this  results  in  programs  with  unachievable  requirements.  In  fact, 
the>  note  that  achieved  versus  specified  MTBF  is  typically  off  about  10:1  and  in  some 
cases  as  much  as  20:1.  (2)  Although  these  statements  were  made  in  1970,  the  situation 

has  not  changed  much.  Mr.  Gregory's  editorial  in  Aviation  Week  noted  the  Defense 
Department's  "...dissatisfaction  with  the  failure  rates  of  systems  and  subsystems." 

(3)  The  same  issue  of  Aviation  Week  contains  a  technical  survey  which  delves  into 
reliability  and  points  out  specific  problems.  (4)  Clearly,  one  important  aspect  of 
reliability  improvement  is  through  appropriate  testing.  Obviously,  you  design  in 
reliability,  not  test  it  in;  but,  testing,  if  judiciously  used,  can  prevent  poor  systems 
from  entering  service  where  the  cost  of  a  failure  is  magnified.  For  example,  in  one 
case  where  new  systems  were  delivered  with  a  failure  rate  of  80%  and  a  corresponding 
$6000  average  repair  cost — the  average  cost  increase  for  delivered  systems  was  about 
$5000--not  an  insignificant  cost. 

In  fact,  the  cost  of  repair  only  covers  a  part  of  the  cost  involved.  A  failed 
system  places  an  undue  strain  on  numerous  resources.  For  a  program  in  the  early  stages, 
it  delays  delivery  of  weapon  systems.  In  addition,  it  causes  the  demand  for  additional 
units  which  in  all  likelyhood  are  not  available  since  the  production  line  is  not  geared 
to  produce  additional  quantities.  As  more  systems  fail  and  are  returned  for  repair, 
they  use  production  facilities  normally  allocated  for  production  of  new  equipment.  The 
situation  can,  if  left  alone,  get  so  out  of  hand  that  deliveries  are  dramatically  reduced. 
To  more  clearly  understand  this  situation--suppo.se  that  the  production  facilities  are 
geared  to  produce  10  systems  per  month.  Further,  consider  a  situation  where  5  systems  a 
month  are  returned  for  major  rework.  Since  a  repair  facility  is  probably  as  yet  not 
available  the  failed  equipment  will  displace  new  equipment  or  just  get  stored  for  later 
work.  In  either  case,  not  a  happy  circumstance.  If  stored,  the  weapon  systems  delivery 
is  potentially  reduced  by  some  50%.  If  repaired  on  production  facilities  and  presuming 
a  worst  case  situation,  then  delivery  of  new  equipment  could  be  reduced  by  up  to  50%-- 
again  leading  to  a  reduction  of  weapon  systems  delivery.  Problems  like  this  do  arise 
with  varying  degrees  of  severity.  Delivery  schedules  are  adjusted  and  means  for  repair 
both  in  plant  and  on  site  are  incorporated — at  additional  cost  to  the  buyer. 

Once  the  equipment  is  fielded — the  situation  takes  on  a  new  complexion.  High  failures 
demand  spares  in  excess  of  planned  purchases  or  result  in  weapon  systems  that  are  not 
mission  capable.  Doing  something  about  the  problem  is  exasperating  to  say  the  least. 
Additional  support  services  are  needed.  Along  with  this,  there  is  a  demand  for  more  and 
more  trained  technicians  in  the  field.  The  funds  for  these  efforts  are  usually  in  short 
supply  and  trained  people  are  harder  to  acquire  and  still  harder  to  keep.  As  newer 
technology  equipment,  becomes  available,  the  argument  is  made  for  solving  the  reliability 
problem  and  acquiring  improved  performance.  And,  the  cycle  begins  again.  It  would  be 
simple  but  foolhardy  to  blame  the  contractor  for  these  problems.  Contracting  for  military 
avionics  is  difficult  since  the  complexity  Is  usually  enormous;  the  development  and 
production  cycle  is  long;  and  the  quantities  are  small.  Clearly,  what  is  needed  is  to 
devise  some  mechanism  to  insure  delivery  of  reliable  equipment.  Specifying  appropriate 
testing  of  all  delivered  equipment.  Is  clearly  an  essential  element.. 


3.  FAILURE-FREE  TESTING 

Hammer  states  that  reliability  demonstration  testing  of  military  electronics  has 
drawbacks,  not  the  least  of  which  is  poor  correlation  with  field  reliability  results 
from  the  small  sample  of  equipment  selected  for  test  and  the  dependence  on  relevant 
failure  classification  which  is  often  inconclusive .( 5 )  From  Aviation  Week  "...Willoughby 
added  that  reliability  testing  only  provides  a  'snapshot'  of  the  system  that  is  not 
always  a  valid  indication  of  what  its  actual  performance  will  be.  And,  if  you  depend 
on  reliability  testing,  it  has  to  come  late  in  the  program  when  the  configuration  is 
stable,  which  is  too  late  to  do  anything  to  fix  problems (6 )  Hammer  suggests  failure- 
free  reliability  testing  based  on  the  testing  of  all  equipment  produced--not  just  a  small 
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sample.  Further,  the  test  should  be  based  on  failure-free  trials  not  relevant  failures. 
The  reason  is  that  it  provides  the  producer  with  a  positive  economic  incentive  to 
implement,  in-line,  the  necessary  corrective  actions.  As  far  as  Hammer  is  concerned, 
failure  analysis  is  performed  solely  for  determining  the  cause  of  failure  and  follow-up 
corrective  aetion--not  for  supporting  non-relevancy  rational. (7)  Figures  1  and  2  show 
the  result  of  requiring  fai lure-fref-  trials  from  his  paper. (ft)  The  figures  are  provided 
to  show  that  depending  on  equipment  and  test  conditions  the  shape  of  the  curve  may  differ. 
The  reader  should  note  that  during  early  trials  there  is  a  sharp  rise  in  the  number  of 
failures.  Further,  the  failure  frequency  drops  and  settles  out.  Finally,  fielded  MTbF 
is  higher  than  the  MTBF  from  the  trials. 


FAILURE-FREE  TRIALS 
FIGURE  1 

10-HR  FAILURE-FREE  TEST 


FI  CURE  2 

FO-HR  FAILURE-FREE  1EST 


Anderson's  report  (9),  prepared  for  the  Flight  Dynamics  Laboratory,  surveyed  industry 
practice  and  opinions  concerning  environmental  burn-in  of  avionics.  ' N '  sequential  failure 
free  cycles,  where  • N '  varied  from  supplier-to-suppler,  was  embodied  in  tests  of  all 
equipment  shipped.  According  to  the  report,  temperature  cycling  is  often  used  to 
precipitate  equipment  defects  while  some  suppliers  also  use  vibration  (53%  had  experience 
with  random  vibration).  The  report  assesses  the  technical  merit  of  environmental  burn-in 
along  two  lines.  First  it  surveyed  industry  and  second  it  evaluated  the  effectiveness 
of  this  type  of  testing. 

(a)  Industry  Survey  Results  (10)  -  The  thermal  cycle  is  the  primary  environmental  screen. 
Cycle  lengths  of  six  to  eight  hours  is  most  common.  The  number  of  cycles  varies 
with  four  and  ter  cycles  being  quite  prevalent.  According  to  the  survey,  parts  such 

as  defective  ICs  and  semiconductors  accounts  for  almost  half  the  failures.  Workmanship, 
largely  soldering,  represents  about  a  third  of  the  failures.  The  use  of  temperature 
cycling  and  random  vibration  (not  necessarily  together)  was  considered  the  most 
effective  in  stimulating  failures.  As  for  the  failure-free  requirement,  industry  in 
general  felt  that: 

(1)  it  should  be  used  as  a  confirmation  of  system  integrity, 

(2)  experience  shows  it  is  an  exceptional  tool, 

(3)  military  customers  should  specify  the  failure-free  period  in  a  temperature/ 
vibration  environment  and  let  the  contractor  selc~t  screens. 

(4)  an  investigation  of  the  length  of  failure-free  operation  is  needed. 

In  addition,  the  survey  noted  that  the  greatest  potential  was  in  accelerating  test 
time  by  increasing  the  frequency  of  cycling  and  reducing  the  duration  of  each  cycle. 

For  the  near  term  (3-5  years),  the  survey  revealed  that  stimulation  of  defects  will 
continue  to  be  the  primary  method  of  testing.  For  the  moment,  concern  centers  on 
what  type  (random)  or  sinusoidal)  vibration  and  level  to  use  and  where  to  place  it 
in  the  test  cycle  (i.e.  before,  and/or  in  the  middle,  and/or  the  end  of  the  failure- 
free  cycle).  The  far  term  is  less  clear.  The  possibility  exists  for  a  shift  to 
combined  environments  testing  which  simulates  the  service  or  operational  environment. 
(Note:  the  literature  normally  refers  to  this  as  Combined  Environments  Reliability 

Testing  or  CERT.  As  with  PRVT  and  PVT,  CERT  is  sometimes  referred  to  as  CET  since 
in  some  cases  it  is  not  the  intent  to  so  much  establish  reliability  as  it  is  to 
find  and  fix  design  deficiencies.) 

(b)  Results  -  "Analysis  of  environmental  burn-in  tests  shows  that  the  selected  LRUs 
display  four  common  attributes:  1)  a  decreasing  failure  rate  in  the  first  few 
cycles  (reliability  improvement),  2)  a  relatively  constant  failure  rate( subsequent ly 
no  reliability  improvement),  3)  a  'reburn-in1  characteristic  for  failed  units 
(reliability  improvement  after  failure  and  repair),  and  4)  a  relatively  large 
acceptance  test  rate  at  the  end  of  environmental  burn-in  (performance  test  in 
environmental  burn-in  not  as  thorough  as  acceptance  testing)".  (11)  The  following 
figures,  related  to  inertial  systems,  are  extracted  from  the  report  to  show  various 
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aspects  of  this  testing.  Figure  3  shows  the  production  flow  j  r>. ;  wi.i  ;«•  Figure  4 
shows  the  burn-in  characteristics.  ( \2)  Note  that  in  some  care.-,  the  ;■<  w.-r-  .'  i:  irl 
Figure  4  may  occur  at  both  low  temperature  and  at  high  temperature  wits  .11  eyrie 
before,  in  between  and  at  the  end.  This  leads  to  two  operations,  :  r.  .  r.e  complete 
cycle.  Figure  5  shows  the  random  vibration  profile.  (13)  N(  t<  that  the  general 
procedure  now  is  to  use  the  expected  vibration  for  the  specific  installation.  In:, 
means  random  vibration  for  .jet  aircraft  and  sinusoidal  for  reciprocating  aircraft 
and  helicopters.  Finally,  Figure  i.  shows  the  failure  rate  at  the  1  n  cycle  burr.- in 
point . ( 14 ) 


Vibration ■  2  2  gpk  at  48  Hz  for  tO  mm  Each  on  Hour  (V) 

IMU  Cooling  Air  Flo*  3  lb/mm  at  -60°C  for  Power  Off 
1  lb/mm  at  29  4°C  for  Power  On 
Performance  Test  Functional  Test  Continuous  During  Power  On 


Figure  3  •  INS  Production  Process  Flow 


Figure  ^  INS  LRU  and  Set  Burn-In  Characteristics 
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Figure  5  INS  LRU  Vibration  Test 


VT  0.  30  - 


0.2B  - 


CYCl.es  <;> 

Figure  6  INS  IMU  Failure  Rale  for  First  Failure  00  Cycle  Burn  In) 


4.  MODELLING  FAILURE-FREE  CYCLES 

(a)  Model  Development  -  The  initial  attempt  was  to  develop  an  equation  or  set  of  equation** 
that  portrayed  the  events  involved  in  failure-free  ovdic  testing.  The  intent  was  to 
provide  a  simple  quick  solution  that  related  failures  to  trials  (or  cycles)  and 
reliability.  The  math  involved  got  nopelessly  involved.  The  approach  was  therefore 
taken  to  model  the  process  on  a  computer  using  random  number  generators  to  represent 
the  failure  mechanisms.  Figure  7  presents  a  simple  version  of  ‘he  flow  diagram  used. 
Initialization  parameters  included  the  MTBL  of  the  equipment,  the  number  of  cycles, 
the  percentage  of  equipment  expected  to  be  bad-on-arrival  (more  is  said  about  this 
later)  and  the  number  of  equipments  to  be  tested  in  any  particular  lot.  Results  of 
the  process  were  tracked  and  stored  throughout  the  test.  For  example,  when  a  line 
replaceable  unit  (LRU)  failed-the  cycle  in  which  it  failed  was  stored.  The  number  of 
total  cycles  needed  to  complete  "n"  sequential  failure-free  cycies  was  also 
accumulated  and  kept  for  later  printout.  For  the  model  tc  have  any  value,  it  must 
replicate  actual  results  with  reasonable  fidelity.  Figure  B  shows  a  composite 
portrayal  of  typical  results  from  a  number  of  contractors  on  their  recent  test  results. 
Note  that  in  the  early  cycles  there  is  a  high  incidence  of  failure. 
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(b) 


However,  as  the  number  of  cycles  is 
increased--the  frequency  of  failures 
drops  and  then  settles  to  a  constant 
failure  rate.  Modelled  with  a  single 
failure  rate  mechanism,  the  results 
were  as  shown  in  Figure  9.  The  curve 
is  relatively  flat  throughout. 

Thinking  about  this  in  retrospect,  its 
clearly  what  you  should  expect  given 
the  conditions.  The  model  was  then 
adapted  to  include  a  second  and  very 
low  MTBF  operating  along  with  the 
normal  equipment  MTBF.  The  way  this 
was  modelled  was  to  have  the  low  MTBF 
occur  with  a  frequency  defined  as 
some  percentage  of  bad  or.  arrival. 

With  a  randc  rr,  number  generator  these 
equipments  which  were  selected  as  bad 
had  a  low  MTBF  the  rest  had  a  high 
MTBF.  Those  with  a  low  MTBF  were 
repeated  as  "repaired"  (in  a 
computa  ,  ional  sense)  until  they  passed 
the  sequential  failure-free  test.  The 
shape  resulting  from  this  approach  was 
very  nearly  in  agreement  with  that  of 
contractor  results.  What  was  needed, 
however,  was  a  reasonable  estimate  of 
both  MTBFs  and  how  they  operated. 

Reliability  -  Expected  equipment, 
reliability  was  established  by  using 
a  technique  developed  by  the  Charles 
Stark  Draper  Laboratory  (CSDL)(15) 
and  refined  by  the  National 
Aeronautics  and  Space  Administration 
(NASA)  (16).  The  CDSL  report, 
according  to  NASA,  found  that  failure- 
nodes  "...are  due  to  mechanical, 
thermal,  and  electrical  stresses 
caused  by  operating  time,  turn-on/ off 
cycles,  calendar  time  or  aging,  and 
environment..."  (17)  It  is  within 


Fici'Ki:  7 


this  framework  that  the  report  COMI’I'TER  FLOW  niAGRAM-PVT 

distinguishes  between  predicted 
failure  rate  (  \o )  and  total  failure 
rate  (  \t)  in  actual  system  operational 

experience  and  relates  one  to  the  other.  Eq  (1)  shows  th"  relationship  that  exists 
between  the  various  failure  modes  and  total  failure  rate. 


t  \  =  t\  +  c  X  +  8760  X  ( 1  ) 

toe  a 

The  symbols  were  previously  defined  but  the  8760  preceding  "  Xg"  corresponds  to  the 
number  of  hours  in  a  year.  For  purposes  of  this  paper,  it  is  assumed  for  inertial 
systems  that: 

A  a  ~ (  2  ) 

10 


500 


(3) 


This  is  based  in  part  upon  the  data  presented  in  the  NASA  report  and  in  part  by 
judgement.  Users  can  apply  this  assumption  as  a  first  cut  approach  to  their  work— 
but,  for  detailed  analysis  a  substantiated  value  for  "  and  "  "  is  suggested. 

The  resulting  equation  used  for  determing  operating  rel?ability  iS  therefore: 


Xf  =  (t  +876)  +  c  p 

500 


(4) 


Given  this  equation  -  what  can  we  infer?  For  one  thtng--in  a  commercial  environment 
given  that: 

t  =  5000  hrs  (per  year  of  operation) 

\c  =  1/4000  ( i . e . -4000  predicted  MTBF;  (5) 
c  =  500  turn  ons  (in  a  year) 

the  operating  MTBF  is  about  ?000  hours.  For  a  nominal  fighter  environment,  given: 
t  =  500 

\G  =  ?.  1/4000  (6) 

c  =  500 

--the  resulting  operational  Mn’HF  is  about  **00  hours. 
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No**1  that  the  predicted  A0  is  doubled  to  account  for  increased  temperature  effect.':. 
Phis  exercise  is  important  because  it  not  only  explains  the  difference  that  exists 
between  expected  military  and  commercial  failure  rates  but  is  also  an  important 
step  in  modelling  the  expected  MTBF  of  a  system  when  undergoing  a  sequential 
failure-free  test.  Two  factors  dominate.  First,  temperature  doubles  failure  rate. 
Second,  cyclin,.  the  systems  on  and  off  (and  allowing  sufficient  time  between  cycles— 
usually  about  an  hour)  stimulates  failure  modes  (recall  the  previously  noted 
industry  survey  results).  Based  on  these  factors,  it  seems  that  inertial  systems 
with  a  predicted  MTHF  of  about  4000  hours  will  have  about  400  hour  MTBF  in  a  PVT 
chamber  when  exposed  to  temperature  cycling. 

(c)  Model  Validation  -  Data  was  collected  from  various  manufacturers  who  had  used 

different  forms  of  PVT.  The  model  was  adjusted  to  reflect  the  number  of  systems 
tested  and  the  total  number  of  cycles.  I’ycle  here  Is  defined  as  one  ori-off  period. 
This,  in  keeping  with  Eq  (4i,  is  an  important  factor  since  in  many  cases  there  are 
two  on-off  periods.  In  the  first  case,  the  equipment  is  subjected  to  a  low  temper¬ 
ature  turn  on  and  operation.  The  combination  of  a  high  and  low  tern; erature  opera¬ 
tion  is  considered  one  cycle  for  contract  test  purposes.  The  reader  should  there¬ 
fore  note  that  throughout  this  test— a  cycle  represents  one  turn  on  and  turn  off 
unless  otherwise  noted.  The  computer  model  was  first  adjusted  so  that  ttie  steady 
state  failure  rate  was  very  nearly  duplicated.  This  was  done  by  taking  the 
predicted  failure  rate  and  adjusting  for  temperature,  number  of  turn-on/off  cycle:;, 
and  total  operating  hours.  Since  Eq  (4)  is  based  on  yearly  data--all  numbers  were 
adjusted  to  reflect  such  an  operation.  Then  the  bad-on-arrival  percentage  and  the 
corresponding  low  MTBF  was  adjusted  to  nearly  reproduce  the  actual  experienced 
failures.  Figure  10  shows  the  comparison  of  actual  versus  computed  PVT  results. 

To  facilitate  interpretation  and  preserve  the  identity  of  the  manufacturers,  the 
failure  frequency  data  is  a  composite  using  a  five  point  running  average  with  the 
failure  frequency  unquantified.  As  can  he  observed,  the  model  reasonably  replicates 
the  actual  events  for  the  circumstances  encountered.  The  variations  in  the  plot 
results  from  discrete  failures  occuring  randomly  (or  pseudo-randomly  in  the  model) 
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SAMPLE  FAILURE  PROFILE 


5.  INTERPRETING  FAILURE  FREE  RESULTS 

An  examination  of  Figure  10  shows  that  there  is  a  high  failure  frequency  in  the 
early  cycles  and  that  failure  frequency  settles  to  a  steady  state  value.  For  the 
comparison  case,  the  steady  state  situation  for  a  30  cycle  test  is  achieved  in  about 
15  cycles.  The  steady  state  failure  frequency  represents  the  inherent  MTBF  of  the 
system  under  test  at  accelerated  conditions.  Remember  the  equipment  is  subjected  to 
temperature  extremes -turn  on  and  off  is  frequent  and  operating  time  is  high.  Data 
gathered  in  this  region  can  be  used  to  roughly  predict  operational  MTBF.  To  accomplish 
this  the  failure  frequency  over  the  steady  state  region  should  be  accummulated  for  a 
substantially  larger  sample — on  the  order  of  one  hundred  or  more  systems.  Clearly,  thi 
should  be  over  a  well  defined  steady  state  region.  Figure  11  shows  a  plot  of  failures 
versus  test  MTBF  and  assumes  that  the  only  failure  mechanism  present  is  operational 
failure  frequency.  That  is  to  say  there  are  no  manufacturing  defects  that  lead  to  bad- 
on-arrivals,  i.e.  early  failures.  If  you  have  been  collecting  data  on  some  150  systems 
based  on  a  30  sequential  failure  free  cycle  test  and  fc  nd  that  the  last  half  of  your 
plot  of  failure  frequency  to  cycles  produced  fifteen  failures  at  nearly  steady  state — 
then  you  could  estimate  that  the  systems  had  a  test  MTBF  of  about  POO  hours.  (Note 
tne  failures  have  to  he  doubled  to  translate  15  cycles  to  thirty  and  then  multiplied 
by  100/150  to  correspond  to  the  curve).  Using  Eq  (4)  it  is  possible  to  compute  \v  and 
then  recompute  a  new  total  failure  rate  (  J^t)  for  expected  operational  tests. 


NUMBER  OF  FAILURES 
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(a)  Effects  of  Varying  Early  MTBF  -  Two  questions  are  posed.  Suppose  you  want  to 
determine  the  effects  of  both  variations  in  early  MTBF  and  bad-on-arrivals. 

Figure  12  shows  the  effects  of  varying  the  early  (or  process  control)  MTBF. 

This  figure  shows  the  computer  simulation  of  the  random  process  for  two  different 
values  of  early  MTBF— 2  hours  and  5  hours.  In  this  simulation  the  total  number 
of  systems  tested  were  500.  Bad-on-arri val  was  held  constant  at  15%  and  the  test 
MTBF  was  400  hours.  PVT  was  based  on  30  sequential  failure  free  cycles.  Simulation 
results  were  plotted  by  using  a  five  point  running  average  to  smooth  out  the  data. 
For  the  2  hour  MTBF — 128  failures  were  encountered.  Of  these  about  42  represented 
steady  state  failures  traceable  to  the  inherent  reliability  of  the  system.  Two 
thirds  of  the  failures  are  related  to  early  or  process  control  failures.  Note  that 
steady  state  was  encountered  somewhat  prior  to  the  15th  cycle.  For  the  systems 
"tested"  it  took  an  average  of  31.8  cycles  to  pass  the  necessary  30  sequential 
failure  free  cycles.  In  fact,  384  systems  completed  test  without  failure — 95 
systems  completed  testing  between  31-45  cycles--18  systems  needed  40-60  cycles  and 
3  units  required  between  61  and  90  cycles.  This  is  mentioned  in  order  to  put  the 
31.8  cycle  average  in  perspective  and  at  the  same  time  focus  attention  to  the  fact 
that  testing  can  in  some  cases  be  quite  lengthy.  When  early  MTBF  is  increased  to 
5  hours  with  other  factors  held  constant  to  the  same  previously  noted  values,  the 
total  "failures"  encountered  was  practically  the  same.  The  major  difference, 
however,  was  that  the  average  number  of  cycles  increased  to  32.2 — but  more 
importantly  the  point  at  which  steady  state  was  attained  shifted  somewhat  past  the 
15  cycle  point.  Comments  and  data  from  most  contractors  indicate  that  15  cycles 
(as  defined  herein)  is  about  the  point  at  which  steady  state  in  reached.  Discount¬ 
ing  some  of  the  variation  in  test  methods  (i.e.  equipment  reliability,  turn  on  and 
off  cycles  and  total  operating  time)  and  accepting  the  model  as  described,  the 
simulation  was  suggested  that  early  MTBF  is  probably  between  2  and  5  hours. 
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(b)  Effects  of  Varying  Bid-On-Arri val  (BOA)  -  Figure  13  shows  the  effects  of  varying  BOA 
while  holding  above  rioted  assumption  to  the  same  values  except  that  early  MTBf  is  ? 
hours.  As  might  be  expected,  BOA  largely  affected  the  frequency  of  early  failure.'  . 
Table  I  summarizes  the  more  important  data.  Again,  the  average  number  of  cycles  to 
complete  30  sequential  failure  free  cycles  was  about  3?.  lor  BOO  systems  tested, 
this  means  about  1000  cycles  more  than  the  15000  for  a  perfect  system.  The 
important  factor  is  that  more  than  ?/3  of  the  failures  were  early  failures  that 
were  detected  largely  within  15  cycles. 

(c)  Actual  Experience  -  Recent  experience 
suggests  that  the  above  model  reasonably 
portrays  reality.  The  model  must, 
however,  be  adjusted  to  reflect  the 
fact  that  in  some  cases  early  MTBF 
associated  with  bad-on-arrival  does  not 
sharply  increase  upon  "repair".  In 
fact,  the  data  would  suggest  a  high 
BOA  when  in  fact  it  is  small  coupled 
with  repeat  offenders.  A  more 
important  factor,  however,  is  that  in 
long  production  runs--the  plot  of 
failure  frequency  shifts  downward. 

That  is  to  say — as  fixes  are  found  and 
incorporated  in  subsequent  units 
subjected  to  failure  free  testing--the 
total  number  of  failures  is  decreasing. 

Figure  14  shows  a  large  production  run 
with  failure  frequency  over  succeeding 
lots.  Clearly,  there  is  a  shift  in 
the  early  failure  rate  indicating  that 
the  manufacturer  took  steps  to  preclude 
failure  of  succeeding  equipment 
subjected  to  PVT.  Uncertainty  concerning  company  liability  is  now  certainly  better 
understood.  Early  on,  many  assumed  that  testing  could  easily  cost  considerably  in 
time  and  money.  This  stemmed  from  the  fact  that  the  total  amount  of  PVT  cycles  to 
satisfy  "n"  sequential  failure  cycles  was  considered  indete.-minant .  Therefore,  the 
venture  was  assumed  quite  risky.  What  most  found  was  that  except  for  early  systems-- 
delivery  was  not  affected.  It  should  be  pointed  out  that  early  system  delivery 
while  a  problem — shifts  the  problem  away  from  the  field  and  focuses  immediate 
attention  to  fixing  the  problem.  This  is  as  it  should  be  since  field  problems 

are  quite  expensive  and  incur  pipelines  "costs"  as  well.  With  a  better  under¬ 
standing  of  PVT  there  has  come  more  approval  by  the  manufacturers.  Later 
deliveries  are  no  problem.  In  fact,  since  PVT  filters  out  the  bad  actors — returns 
of  failed  equipments  is  dramatically  reduced.  This  has  two  positive  impacts.  First, 
systems  delivered  will  tend  to  show  a  reliability  more  in  line  with  expected  total 
failure  rate  for  the  particular  use  (recall  the  earlier  application  of  the  NASA 
equation  considering  temperature,  operating  time  and  turn-on/off  cycles).  Secondly, 
because  the  bad  actors  are  filtered  out,  tne  pipeline  back  to  the  repair  facility 
(probably  the  manufacturer)  is  reduced  and  the  workload  and  subsequent  deliveries 
are  maintained. 

If  there  is  any  problem,  it  lies  in  two 
areas.  First,  the  length  of  testing, 
i.e.  the  number  of  cycles  and  secondly, 
the  reporting  associated  with  failures 
in  the  PVT  cycle.  Depending  on  the 
manufacturer  and  his  contractual 
obligations — there  is  a  feeling  by  some 
that  the  number  of  PVT  cycles  should  be 
reduced  to  the  point  at  which  it  settles 
out — rather  than  going  to  30  trials  (or 
15  cycles  in  cases  where  there  is  a  cold 
and  hot  turn-on  and  off  within  a  cycle, 
i.e.  two  trials  within  one  cycle).  As 
for  reporting,  most  contractors  agree 
with  Hammer  (as  previously  noted)  that 
failure  analysis  is  performed  solely 
for  determining  the  cause  of  failure 
and  follow-up  corrective  action.  The 
problem  is  that  some  contracts  call  for 
detailed  failure  analyses.  This  is 
appropriate  for  formal  reliability  tests 
where  the  sample  size  is  small  (say 
three  or  four  systems).  In  the  case  of 
PVT  where  every  system  manufactured  is 
tested  to  cull  out  darly  failure  rate 
prone  systems — the  value  of  such  reports 
is  questionable.  Certainly,  no  such 
report  is  required  had  the  system  failed  in  the  field.  One  approach  to  reducing 
the  number  of  reports  is  to  conduct  an  out  of  PVT  cycle  test  if  a  unit  has  failed 
prior  to  an  "n"  sequential  failure  free  test.  This  rightly  assumes  that  a  failure, 
if  it  is  going  to  occur,  will  most  likely  occur  in  the  first  cycle.  statistically, 
it.  reduces  the  number  of  failure  report.';  but  it.  adds  one  more  cycle  to  the  overall 
test  program.  Such  an  approach — reduces  the  number  of  reports  but  increase;  cost 
and  schedule  in  subtle  ways.  Because  of  the  expected  number  of  fai lures — a  possible 
approach  is  a  simple  tabular  report,.  It  could  for  example  report  LRIJ  number,  shop 
replaceable  unit  number,  assembly  number,  part  type  and/or  number,  time,  cycle 
number,  types  of  cycle  (e.g.  high  or  low  temperature  turn-on,  or  vibration),  etc. 


TABLE  I 


Bad-0n-Arri va  1 

15*1 

307. 

607. 

Total  Failures 

128 

186 

366 

Average  Cycles 
Units  Passed  In: 

31.8 

32.2 

33. 

30  Cycles 

384 

325 

166 

30-45  Cycles 

95 

153 

312 

46-60  Cycles 

18 

19 

17 

61-90  Cycles 

3 

3 

5 

NOTE:  MTBF  =  400 

Hours 

Early  MTBF  = 

2  Hr s 

Trials  =  30  Cycles  Units  Under  Test  -  300 
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h.  finding;; 

First,  and  foremost,  it  is  clearly  evident  that  PVT  can  be  modelled  on  a  computer. 

Using  random  number  processes — the  model  is  comprised  of  two  MTBFs.  The  larger  value 
represents  the  expected  MTBF  of  the  equipment  for  the  test  conditions,  i.e.  frequent 
turn-on/off,  extremes  in  environment,  etc.  The  smaller  value,  usually  on  the  order  of 
?  hours  MTBF  but  coupled  to  a  bad-on-arri val  (for  example  15%  and  higher)  reasonably 
correlates  with  actual  test  results.  A  two  hour  MTBF  coupled  with  the  bad-onGarri va] 
rate  used  for  modelling  purposes  tends  to  portray  the  defective  parts  and  workmanship 
that  have  been  stimulated  to  fail.  The  persistance  of  the  low  MTBF, given  a  repair  has 
been  effected > appears  to  depend  upon  the  degree  of  parts  screening  and  workmanship.  If 
anything — this  low  MTBF  does  not  appear  to  grow  i.e.  reflect  MTBF  maturation.  What  does 
happen  is  that  equipments  tested  in  a  PVT  environment  screen  out  the  defective  parts 
and  workmanship  problems  through  repeated  turn-on  and  off  in  the  presence  of  temperature 
vibration.  It  is  for  this  reason  that  there  is  such  a  dramatic  improvement  in  fielded 
reliability.  This  certainly  reaises  the  question  of  effective  parts  screening  at 
incoming  inspection.  It  would  appear  that  this  could  be  improved,  but  it  is  doubtful 
that  it  can  screen  out  all  marginal  parts.  PVT  is  important  because  it  focuses  attention 
on  failed  parts  at  system  level  operation.  Most  importantly,  it  does  that  at  the 
manufacturers'  facility  where  configuration  control  is  possible.  Therefore,  the 
manufacturer  can  effect  necessary  changes  in  parts  and  workmanship  since  he  has  the  audit 
trail  readily  available. 

Second,  the  analysis  of  the  PVT  model  and  examination  of  contractor  data  suggests 
that  roughly  15  sequential  failure  free  cycles  are  necessary  to  screen  out  defective  parts 
and  workmanship  problems.  Recall  here  that  cycle  refers  to  one  turn-on/off  event.  For 
some  contractors  who  currently  use  one  high  temperature  and  one  low  temperature  turn-on 
(i.e.  two  distinct  events)  this  would  correspond  to  7  or  8  cycles.  This  assumes  that 
the  lower  value  MTBF  (MTBF^  about  2  hours)  is  a  reasonable  characterization  of  the 
problems  and  that  it  does  not  get  any  better.  In  fact,  the  more  likely  situation  is 
that  the  turn-on/off  cycle  coupled  with  environmental  conditions  probably  shocks  the 
system  and  are  not  entirely  time  dependent.  The  question  then  is,  are  more  cycles 
necessary  and  for  what  reasons?  The  answer  is  yea.  For  the  moment,  we  are  not  absolutely 
assured  that  the  lower  value  MTBF  is  exactly  2  hours.  Clearly,  it  is  necessary  to  conduct 
sufficient  "n"  sequential  failure  free  cycles  in  order  to  reach  a  steady  state  failure 
frequency.  This  is  necessary  in  order  to  screen  out  the  non-random  failures.  A  second 
and  equally  important  reason  is  to  have  data  over  a  sufficient  number  of  cycles  to 
establish  a  constant  failure  frequency.  This  facilitates  the  estimation  of  system 
reliability  under  test  conditions  which  can  be  translated  to  the  operational  MTBF  using 
the  NASA  equation.  While  it  is  not  the  intent  to  use  PVT  to  establish  reliability — it 
is  certainly  important  to  have  a  reasonable  estimate  of  system  MTBF. 

Third,  as  noted  above,  turn-on/off  cycling  is  a  key  element  as  is  operating  time. 
Therefore,  it  is  important  to  stimulate  these  non-random  failures  as  expeditiously  as 
possible.  The  amount  of  on-time  for  any  particular  cycle  depends  on  the  data  required. 

For  inertial  systems — one  hour  is  usually  sufficient  to  give  a  reasonable  indication 
of  system  performance.  The  amount  of  off-time  depends  on  the  test  parameters.  Thermal 
extremes  and  the  time  to  approach  steady  state  values  dictate  off-time  between  cycles. 

A  combined  environments  chamber  incorporating  the  PVT  cycles  is  an  ideal  approach.  This 
is  not  essential.  In  fact,  recent  experience  with  random  vibration  incorporated  at  the 
beginning  and/or  at  the  endo  of  "n"  sequential  failure  free  tests  where  temperature 
cycling  is  used  has  been  fairly  effective.  An  effective  cycling  approach  is  one  hour  on — 
one  hour  off.  This  type  of  cycling  given  the  environment  and  Eq  (4)  accelerates  random 
failures  frequency  and  stimulates  failure  of  non-random  problems.  This,  however,  does  not 
overstress  equipment  or  reduce  its  life.  If  you  recall,  the  model  results  (which  also 
reasonably  protrayed  the  actual  experience) — it  took  on  average  32  cycles  to  pass  a  required 
30  sequential  failure-free  test.  Even  if  it  took  a  few  hours  per  cycle,  the  total 
accumulated  hours  would  not  exceed  100.  The  environment  usually  reflects  expected  vibration 
and  expected  temperature  extremes. 

Fourth,  PVT  significantly  improves  the  probability  that  delivered  systems  meet  their 
design  reliability.  It  does  this  because  all  delivered  systems  are  subjected  to  "n" 
sequential  failure  free  tests.  If  it  does  nothing  else,  it  keeps  the  undivided  attention 
of  manufacturer  from  beginning  to  end.  Because  of  this,  any  fai 1 ure--part i cularly  with 
initial  deliveries — will  be  scrutinized  very  carefully.  For  example,  in  a  large  production 
of  1000  units  a  repeat  failure  for  999  times  not  only  cost  cycles  but  also  repairs.  This 
explains  the  improvement  shown  in  Figure  14. 

Fifth,  while  PVT  significantly  improves  the  probability  of  higher  reliability,  it  is 
not  a  substitute  for  good  design  practice.  Clearly,  you  cannot  test  reliability  into  a 
poorly  designed  product.  What  was  particularly  fascinating  about  the  analysis  and 
modelling  of  PVT  was  that  evidently  the  manufacturers  had,  in  fact,  done  an  excellent  job 
of  design.  The  steady  state  failure  frequency  when  translated  through  the  NASA  equation 
(i.e.  Eq  (1))  fairly  well  corresponded  with  the  design  and  operational  MTBF.  The  fact 
that  they  experienced  problems  of  low  MTBFs  is  largely  traceable  to  defective  parts  and 
workmanship  (i.e.  process  control).  When  these  were  attacked  through  PVT--the  resulting 
MTBF  of  delivered  equipment  approached  expected  operational  MTBF.  In  fact,  in  dealing 
with  reliability,  it  should  be  based  on  the  steady  state  failure  frequency  as  noted  earlier. 
Operational  reliability  predictions  based  on  all  PVT  failures  is  misleading  because  it 
includes  non-random  data.  Figure  2  shows  that  failure  free  testing  resulted  in  an  87 
hours  MTBF  while  actual  field  MTBF  was  540  hours.  Similar  experience  was  developed  by 
manufacturers  who  applied  PVT  or  versions  of  It  prior  to  shipping  '-quipment. 
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Sixth,  the  early  failure  phenomenon  is  clearly  worth  particular  attention.  The 
model  results  as  compared  to  recent  manufacturers  tests  imples  an  MTBF  of  a  few  hours. 
Anderson  (18)  suggests  that  failures  that  occur  in  initial  cycles  represent  defects 
rather  than  chance  failures.  Bezat  et.al.  (19)  are  of  the  opinion  "...that  infanct 
mortality  is  in  all  probability  a  misnomer ...  in  fact,  most  solid-state  electronics 
piece  parts  have  such  a  long  life  that  every  true  failure  within  a  given  population  of 
(actively  stressed)  parts  improves  the  reliability  of  the  remainder  of  that  population..." 
This  explain  why  the  early  low  MTBF  had  to  be  mechanized  as  a  non-linear  function  with 
a  bad-on-arrival  rate  statistical  "switch".  In  fact,  it  means  that  attaining  design 
reliability  is  highly  improbable  unless  screens  like  PVT  are  incorporated  to  cull  out 
defects  so  that  only  chance  failures  are  left.  Given  that  we  are  dealing  with  defects 
and  not  chance  events  means  that  we  should  take  another  look  at  reliability  estimates 
and  projections  based  on  the  Duane  (20)  reliability  growth  model 

\^=  KH  (7) 

The  equation  imples  that  reliability  is  improving  as  hours  are  accumulated  and  that 
the  improvement  is  a  function  of  the  value  of  alpha.  Selby  (21)  indicates  that  an 
alpha  of  "...of  0.1  can  be  expected .. .where  no  specific  consideration  is  given  for 
reliability ... (and)  0.5  for  a  hard-hitting  aggressive  reliability  program..." 

The  question  is — what  are  appropriate  values  and  what  is  the  basis  for  them  when  you 
consider  that  many  failures  are  not  random  in  nature  and  not  purely  infant  mortality? 


7.  CONCLUSIONS 

Production  Verification  Testing  (PVT)  can  be  modelled  on  a  computer.  Simulation  and 
comparisons  with  actual  data  indicate  that  for  'N'  sequential  failure  free  testing, 
there  is  an  early  and  high  incidence  of  failures.  This  is  followed  by  a  decline  in 
failure  frequency  which  approaches  a  constant  failure  rate.  To  replicate  this,  the  model 
is  best  represented  by  two  MTBFs .  The  first  is  the  MTBF  expected  for  the  environment. 
This  figure  can  be  estimated  using  the  NASA  equation  (i.e.  Eq  (4)).  The  second  MTBF 
should  be  on  the  order  of  a  few  hours  coupled  with  bad-on-arrival  percentage.  This 
latter  approach  reasonably  models  the  high  incidence  of  failures  early  on  in  failure 
free  testing  and  reflects  the  influence  of  defective  parts  and  poor  workmanship.  This 
second  and  low  MTBF  can  persist,  depending  on  the  extent  of  defects  and  workmanship 
problems  and  give  the  appearance  of  high  bad-on-arrivals .  In  any  event,  from  a  modelling 
viewpoint,  the  MTBF  does  not  improve  or  mature.  About  fifteen  cycles  is  needed  to 
establish  steady  state  failure  rates.  More  cycles — on  the  order  of  thirty — are  suggested 
to  insure  that  steady  values  are,  in  fact,  achieved  and  also  to  roughly  establish  system 
reliability.  Modelling  of  this  type  is  important  since  it  provides  interested  parties 
with  insight  into  their  results.  For  those  just  getting  started,  it  provides  a  tool  for 
establishing  a  rough  quantitative  measure  of  expected  failure,  the  number  of  cycles 
necessary  to  complete  testing  and  the  average  number  of  cycles  to  complete  tests.  With 
early  data  it  is  possible  to  estimate  and  control  problems. 
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SUMMARY 

This  paper  compares  hardware  and  software  requirements  for  guided  missile  flight  control  systems.  The 
utility  and  application  of  three  main  analog  flight  control  systems  are  discussed  -  the  open  loop  system, 
the  rate  gyro  controlled  system,  and  the  accelerometer  controlled  system.  For  each  of  these  analog  sys¬ 
tems,  digital  requirements  are  derived  and  comparisons  of  the  requirements  and  performance  of  each  system 
are  made.  The  discussions  point  out  hardware  and  software  trade-off  issues  that  occur  in  the  design 
process . 


PREFACE 


Modern  homing  missiles  require  flight  control  systems  tailored  to  accomplish  intercept  over  a  pre¬ 
scribed  flight  envelope  at  minimum  cost.  This  paper  examines  flight  control  system  alternatives  in  order 
of  increasing  complexity  and  discusses  the  hardware-software  trade-offs  implied  by  each  alternative.  Miss 
distance  is  the  measure  of  homing  performance,  and  miss  distance  is  affected  by  the  three  main  guidance 
parameters  -  effective  navigation  ratio,  relative  stability,  and  response  time.  The  flight  control  system 
instrumentation  configuration  is  the  significant  factor  in  determining  how  these  guidance  system  param¬ 
eters  vary  with  knowledge  of  aerodynamic  flight  condition  -  altitude,  Mach  number,  angle  of  attack  and 
wind  angle.  The  software  requirements,  which  vary  for  each  flight  control  system,  are  significant  factors 
in  digital  computer  architecture,  sizing,  and  cost. 

The  flight  control  system  utilizes  .  autopilot  that  converts  guidance  system  commands  into  commands 
to  the  control  surface  actuators  (Ref.  1).  The  actuators  in  turn  produce  deflections  of  the  aerodynamic 
control  surfaces  that  cause  the  missile  to  maneuver.  The  resultant  dynamics  may  be  measured  by  rate  gyros 
and  accelerometers  to  form  a  feedback  control  system  that  stabilizes  the  airframe  and  produces  the  fast 
flight  control  transient  response  required  for  accurate  homing. 

Three  types  of  analog  control  systems  are  presented  and  analyzed  for  their  performance  properties 
when  used  in  guided  missiles.  The  general  requirements  for  digitizing  these  systems  are  derived  and  some 
pertinent  trade-offs  discussed  to  point  the  way  to  developing  a  minimum  cost  system  to  meet  a  given  tar¬ 
get  threat. 


1.  INTRODUCTION 

The  incorporation  of  tracking  seekers  into  anti-aircraft  missiles  created  a  whole  new  set  of  flight 
control  problems.  Creative  designs  solving  these  problems  emerged  from  all  of  the  engineering  disciplines. 
Aerodynamicists  tailored  the  flight  vehicle  and  its  control  surface  size  and  locations  to  meet  controlla¬ 
bility  requirements.  Servomechanism  designers  developed  control  surface  actuators  to  meet  new  performance 
requirements.  Parasitic  vehicle  control  problems  that  interfered  with  homing  system  performance  emerged. 
The  small  miss  distances  required  magnified  the  importance  of  guidance  component  imperfections  and  dic¬ 
tated  relatively  stringent  control  oi  the  flight  control  system  dynamics  -  acceleration  gain,  time 
constant,  and  relative  stability. 

Homing  missiles  use  a  seeker  to  track  the  target,  a  noise  filter  to  separate  the  relative  target  motion 
from  the  noise,  a  guidance  law  to  generate  the  appropriate  missile  acceleration  commands  to  intercept  the 
target,  and  a  flight  control  system  to  achieve  the  desired  acceleration  response  to  the  guidance  commands. 
(Figure  1)  (Ref.  1,  2,  3).  This  paper  concentrates  on  the  flight  control  system  and  its  interaction  with 
the  missile's  homing  performance.  The  flight  control  system  utilizes  an  autopilot  that  converts  guidance 
system  commands  into  commands  to  the  control  surface  actuators  (Ref.  4).  The  actuators  in  turn  produce 
deflections  of  the  aerodynamic  control  surfaces  that  cause  the  missile  to  maneuver.  The  resultant  dynam¬ 
ics  may  be  measured  by  rate  gyros  and  accelerometers  to  form  a  feedback  control  sytsem  that  stabilizes  the 
airframe  and  produces  the  fast  flight  control  transient  response  required  for  accurate  homing. 

Historically,  at  Raytheon,  radar  guided  missile  development  started  with  the  design  of  a  seeker  that 
was  tested  in  an  available  missile  airframe,  called  the  Lark.  (Ref.  5)  Its  dramatic  success  led  to  the 
development  of  another  seeker  for  the  Navy's  Sparrow  missile  which  in  turn,  led  to  a  completely  new  flight 
control  system.  The  relatively  undamped  airframe  required  a  rate  gyro  for  damping,  and  the  proportional 
navigation  guidance  law  required  lateral  acceleration  control  which  was  achieved  with  missile  body  mounted 
accelerometers  that  developed  an  error  command  between  the  desired  and  achieved  acceleration.  A  low  pass 
filter  was  needed  on  the  acceleration  error  to  attenuate  high  frequency  effects  sensed  by  the  accel- 
ometer,  such  as  structural  vibrations.  As  technology  improved,  the  time  constant  of  this  filter  became 
longer  until  it  approached  an  ideal  integrator.  Such  a  flight  control  system  performed  well  during  the 
glide  phase  of  flight  when  the  missile  airframe  was  aerodynamical ly  stable.  However,  to  reduce  minimum 
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range,  it  was  necessary  to  home  during  the  boost  phase  of  flight,  where  the  missile  airframe  may  be  aero- 
dynamlcally  unstable.  This  was  simply  achieved  by  integrating  the  rate  gyro  to  generate  a  signal  propor¬ 
tional  to  angle-of -attack  and  using  this  signal  to  electronically  add  stability,  called  synthetic  stability, 
to  the  missile.  It  is  a  tribute  to  the  genius  of  its  designers  that  this  three  loop  type  of  flight  con¬ 
trol  system  is  used  in  all  operational  radar  guided  homing  missiles  today,  even  though  the  targets  have 
changed  dramatically  and  the  required  zone  of  performance  has  increased  enormously. 

Until  recent  times  these  autopilot/flight  control  systems  have  been  implemented  using  analog  circuitry. 
However,  with  the  advances  in  digital  computer  electronics  (Ref.  6-10),  modern  missiles  are  becoming  dig¬ 
itally  controlled.  Digital  control  has  many  advantages.  The  first  is  low  cost  because  many  electronic 
functions  are  time  shared  and  because  the  modern  mass  production  manufacturing  technology  for  digital 
computers  is  well  developed.  A  second  advantage  is  adaptability  because  the  computer  can  be  programmed 
to  make  logical  decisions  and  because  these  programs  can  be  changed  if  desired.  A  third  advantage  is  the 
capability  for  built  in  self  test  without  adding  substantially  to  the  amount  of  electronics  on  board  the 
missile.  A  fourth  advantage  is  the  large  dynamic  range  possible  because  dynamic  range  can  be  increased 
by  adding  >its  to  the  word  length.  A  fifth  advantage  is  long  term  stability  -  digital  circuitry  does  not 
have  the  drifts  of  analog  circuitry.  Finally  digital  circuits  are  more  reliable  than  analog  circuits. 

Of  course,  the  advantages  of  digital  control  bring  certain  problems  (Ref.  11).  Special  analog-digital 
and  digital-analog  interfaces  must  be  prepared.  Sampling  data  rates  must  be  high  enough  to  avoid  foldover 
of  high  frequency  phenomena  into  the  low  frequency  control  bandwidth,  and  computer  word  lengths  must  be 
compatible  with  these  data  rates.  Last,  but  not  least,  software  must  be  organized,  programmed,  and 
debugged.  All  of  these  problems  have  been  solved  for  the  designs  currently  developed  at  Raytheon. 
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Figure  1.  Linear  Hiss  Distance  Dynamics 


2.  FLIGHT  CONTROL  SYSTEM  -  GUIDANCE  SYSTEM  INTERACTIONS 

!  \ 

The  guidance  system  must  get  the  missile  close  enough  to  kill  the  target  when  the  warhead  explodes. 

Therefore  an  appropriate  measure  of  guidance  performance  is  miss  distance,  which  is  defined  as  the  minimum 
distance  between  the  missile  and  target.  Two  important  causes  of  miss  distance  in  a  radar  guided  propor¬ 
tional  navigation  system  are  random  target  maneuver  and  target  glint  noise.  The  missile-target  engagement 

model  of  Figure  1  is  used  to  obtain  quantitative  comparisons  of  miss  distance  as  a  function  of  the  signifi-  1 

cant  guidance  system  parameters.  In  turn,  this  information  is  used  to  evaluate  the  effects  of  flight  con¬ 
trol  system  parameters  on  missile  performance. 

i 
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The  flight  control  system  is  represented  by  the  following  transfer  function 


(1) 
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(14  751(  1  4  ^4^-) 


The  values  for  the  zeroes  are  determined  by  the  aerodynamic  configuration.  The  values  for  the  control 
system  gain  K),  the  time  constant  (r),  the  damping  ratio  ({),  and  the  natural  frequency  M  are  deter¬ 
mined  by  the  flight  control  system  gains  and  parameters.  Neglecting  parasitic  effects,  the  guidance  sys 
tem  transfer  function  from  line-of-sight  rate  to  missile  acceleration  (n^A  )(Ref.  4,  12,  13)  is 
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where  N'  is  the  desired  effective  navigation  ratio  (N'  =  KN'0)  Vc  is  the  closing  velocity  and  Ti  and  T2 
ace  the  seeker  and  noise  filter  time  constants. 

The  actual  effective  navigation  ratio  is  one  major  determinant  of  homing  performance.  Typical 
performance  results  displayed  in  Figure  2  show  that  if  the  effective  navigation  ratio  is  too  high, 
miss  distance  increases  du-  to  noise,  and  if  it  is  toe  low,  miss  distance  increases  due  to  target  man¬ 
euver.  Therefore  the  effective  navigation  ratio  has  an  optimal  value  and  in  no  case  should  it  exceed 
certain  bounds,  A  variation  of  the  flight  control  system  gain  K  from  unity  is  equivalent  to  an  effective 
navigation  ratio  change  and  optimal  homing  performance  cannot  be  attained. 


EFFECTIVE  NAVIGATION  RATIO.  N* 


Figure  2.  Effective  Navigation  Ratio  Influences  System  Performance 


Another  major  determinant  of  homing  performance  is  the  guidance  system  time  constant.  With  parasitic 
effects  neglected,  the  guidance  system  time  constant  T_,  can  be  approximated  as  the  coefficient  of  the 
first  order  term  in  the  denominator  of  Eq.  (2)  or  " 
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Therefore  increasing  the  flight  control  system  time  constant,  r,  increases  T^  while  decreasing  that  time 
constant  decreases  the  guidance  time  constant.  Figure  3  shows  that  decreasing  the  flight  control  system 
time  constant  increases  the  miss  distance  contribution  due  to  noise  and  decreases  the  miss  distance  due 
to  target  maneuver,  while  increasing  the  time  constant  does  just  the  opposite.  For  the  set  of  inputs  con¬ 
sidered  it  appears  from  Figure  3  that  the  flight  control  system  time  constant  can  be  made  arbitrarily 
small,  but  this  cannot  be  done  because  of  radome  refraction  effects.  When  the  parasitic  radome  loop  is 
considered  the  guidance  transfer  function  becomes 
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where  R  is  the  radome  slope  and  Ta  is  the  missile  turning  rate  tine  constant.  At  high  altitudes,  where 
Ta  i9  large,  the  guidance  transfer  function  can  become  unstable  due  to  either  excessive  positive  or  nega¬ 
tive  radome  slopes.  Thus  a  small  flight  control  system  time  constant  yields  a  large  guidance  system 
sensitivity  to  radome  slopes  as  shown  in  Figure  4.  Therefore  the  optimal  value  of  the  flight  control 
system  time  constant  is  bounded  on  the  high  side  by  target  maneuver  considerations  and  on  the  low  side  by 
radome  refraction  effects. 


FLIGHT  CONTROL  SYSTEM  TIME  CONSTANT  (sec) 


Figure  3.  Flight  Control  System  Time  Constant  Influences  System  Performance 


Figure  4.  Decreasing  Flight  Control  System  Time  Constant  Makes  System  Performance 
More  Sensitive  to  Radome  Slope 

Flight  control  system  damping  becomes  more  important  when  radome  effects  are  considered.  Figure  5 
shows  typical  high  altitude  performance  for  a  flight  control  system  with  high  and  low  damping.  The  sys¬ 
tem  with  low  damping  is  far  more  sensitive  to  radome  effects  than  the  system  with  higher  damping. 

The  flight  control  system  design  Influences  homing  performance  primarily  through  its  low  frequency 
gain,  its  damping,  and  its  time  constant.  The  low  frequency  gain  variations  modify  the  effective  naviga¬ 
tion  ratio  which  is  important  in  all  homing  applications.  The  damping  affects  the  homing  stability,  which 
is  primarily  Important  in  radar  homing  applications.  The  time  constant  effects  the  homing  dynamic 
response,  which  is  important  in  all  homing  applications. 


V 


s; 


22-5 


Figure  5.  Decreasing  Flight  Control  System  Damping  Makes  System  Performance 
More  Sensitive  to  Radome  Slope 


3.  ANALOG  FLIGHT  CONTROL  SYSTEMS 


Analog  flight  control  systems  require  standard  analog  specifications  of  gain,  bandwidth,  dynamic  range 
and  noise  susceptibility.  The  following  discussion  develops  the  requirements  and  properties  of  analog 
flight  controls  for  open  loop,  rate  gyro  controlled  and  accelerometer  controlled  systems  for  use  in  homing 
guidance. 


Open  Loop  Flight  Control 

The  open  loop  flight  control  system,  shown  in  Figure  6  is  simple  and  requires  no  instrumentation. 

This  system  modifies  the  guidance  command,  n^,  by  a  gain,  KOL.  to  achieve  unity  acceleration  gain  (n^/n^) 
of  the  flight  control  system.  With  the  airframe  transfer  function  given  by 
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(5) 


and  actuator  dynamics  neglected,  the  control  system  transfer  function  can  be  written  as 

2  (6) 
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Figure  6.  Open  Loop  Flight  Control  System 
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Except  for  the  electronic  gain  KoL»  the  flight  control  system  transfer  function  is  that  of  the  bare 
airframe.  Since  a  typical  homing  missile  has  little  aerodynamic  damping,  the  system  transfer  function 
will  be  very  underdamped.  If  an  open  loop  flight  control  system  is  used  in  a  radar  homing  system,  the 
low  damping  will  cause  instability  through  the  parasitic  feedback  caused  by  radome  refraction  slope  (see 
previous  section  and  Ref.  13,  14V  However,  the  open  loop  system  could  be  used  in  a  system  that  does 
not  have  appreciable  radome  refraction  slopes  such  as  an  infrared  system,  provided  that  the  actuator  band¬ 
width  is  low  enough  to  attenuate  the  mechanical  structural  vibrations  of  the  airframe. 

Since  the  system  transfer  function  is  that  of  the  airframe,  the  airframe  must  be  stable  to  obtain 
adequate  homing  performance.  Therefore  the  airframe  requirement  for  this  type  of  flight  control  system 
is  that  the  center  of  gravity  never  moves  aft  of  the  center  of  pressure. 

Unity  acceleration  gain  can  be  achieved  by  making  the  flight  control  system  gain  the  inverse  of  the 
aerodynamic  gain  ,  i.e.: 


K 


OL 


(7) 


Since  the  airframe  gain,  Ki ,  varies  with  flight  condition,  so  will  the  control  system  gain  as  shown  in 
Figure  7.  The  airframe  gain  variations  can  be  compensated  to  the  accuracy  that  the  aerodynamic  data  are 
known.  Inaccurate  compensation  will  degrade  homing  performance  because  the  proper  effective  navigation 
ratio,  N' ,  will  not  be  obtained.  Therefore  missiles  which  use  this  simple  control  system  require 
accurately  defined  aerodynamic  characteristics.  An  actual  history  is  described  in  Ref.  15  where  exten¬ 
sive  full  scale  wind  tunnel  testing  was  needed  to  characterize  the  aerodynamic  gain  accurately  enough  for 
satisfactory  navigation  ratio  control. 


Rate  Gyro  Flight  Control 


The  rate  gyro  flight  control  system  uses  a  rate  gyro  connected  in  a  rate  command  system  as  shown  in 
Figure  8.  With  pitch  rate  transfer  function  dynamics  given  by 
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and  actuator  and  rate  gyro  dynamics  neglected,  the  control  system  transfer  function  can  be  expressed  as 
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Figure  7.  Open  Loop  Autopilot  Gain  Varies  Widely  with  Altitude  and  Mach  Number  Changes 
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Figure  8.  Rate  Gyro  Flight  Control  System 
The  flight  control  system  gain,  K,  provides  unity  transmission  when  set  to 
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+<i-krk3> 

~W" 


(10) 


For  the  usual  case  where  the  loop  gain  | KRK3 |  is  less  than  unity,  this  flight  control  gain  (K)  has  the 
same  variation  as  the  open  loop  gain  but  it  is  magnified  by  the  factor  1/Kr.  Since  Kr  is  usually  less 
than  one,  this  system  is  especially  sensitive  to  altitude  and  Mach  variations.  In  addition,  any  noise  on 
the  conmand  is  magnified  by  the  high  gain.  This  makes  seeker  instrument  noise  requirements  more  stringent 
to  keep  the  command  noise  low.  A  large  dynamic  range  in  the  actuator  electronics  is  required  in  order  to 
avoid  noise  saturation.  Figure  9  shows  a  typical  variation  in  autopilot  gain  versus  Mach  number  and  alti¬ 
tude.  Note  the  large  values  of  gain  required. 
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Figure  9.  Rate  Gyro  Autopilot  Gain  Varies  Widely  with  Altitude  and  Mach  Number  Variations 

The  rate  loop  gain.  Kg,  is  adjusted  to  increase  the  low  damping  of  the  airframe,  as  can  be  seen  from 
Eq.  (9)  to  a  more  acceptable  value  for  radar  homing.  The  dynamic  response  of  this  system  is  essentially 
that  of  a  quadratic  transfer  function  with  good  damping  and  a  resonant  frequency  slightly  higher  than  the 
natural  frequency  of  the  airframe.  Typically  this  frequency  is  high  at  low  altitude,  high  Mach  and 
decreases  as  altitude  and/or  Mach  decreases.  Therefore,  the  response  time  is  short,  but  variable  with 
flight  condition. 

The  open  loop  transfer  function  (HG)  can  be  obtained  from  Figure  8  and  Eq.  (8)  and  is 
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For  cross-over  frequencies  greater  than  the  airframe  roots 


T 


an  approximate  expression  for 


the  crossover  frequency  of  the  asymptotic  Bode  diagram,  is 


XR 


iVSL 
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(12) 


Thus,  the  gain,  Kg,  not  only  determines  the  system  damping  but  also  the  system  cross-over  frequency.  For 
a  design  with  adequate  stability  margins  the  cross-over  frequency  should  be  much  lower  than  the  lowest 
bandwidth  of  the  actuator  or  rate  gyro  bandwidths. 

The  rate  gyro  flight  control  system  has  good  damping,  but  its  acceleration  gain  is  more  dependent  upon 
both  altitude  and  velocity  than  the  open  loop  system.  Its  time  constant  is  short,  but  dependent  on  aero¬ 
dynamic  parameters  of  altitude  and  Mach  number. 

Long  range  homing  takes  place  after  the  missile  fuel  has  been  expended  and  the  missile  center  of  grav¬ 
ity  is  forward  of  its  center  of  aerodynamic  pressure.  This  is  a  stable  conf iguration  and  is  evidenced  by 
a  positive  value  for  B12  in  the  aerodynamic  transfer  functions  or  similarly  by  a  negative  moment  due  to 
angle-of-attack.  However,  for  short  range  intercepts  before  the  missile  fuel  has  been  expended,  the  mis¬ 
sile  center  of  gravity  may  be  aft  of  the  center  of  pressure.  This  is  an  unstable  configuration  and  is 
evidenced  by  a  negative  value  for  B12  or  a  positive  moment  due  to  angle-of-attack  change.  Stability  can 
be  regained  by  integrating  the  rate  gyro  to  obtain  a  signal  proportional  to  angle-of-attack  over  short 
intervals.  This  signal  drives  the  rate  loop  and  supplies  an  electronic,  or  ’’synthetic,"  stability  to 
the  inherently  unstable  airframe.  The  block  diagram  is  shown  in  Figure  10.  The  closed  loop  transfer 
function,  neglecting  actuator  and  rate  gyro  dynamics  can  be  expressed  as  the  following  cubic. 
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Figure  10.  Integrated  Rate  Gyro  Flight  Control  System 

For  unity  transmission,  the  autopilot  gain,  Kg«  is  proportional  to  the  ratio  of  th>  airframe  rate  and 
acceleration  gains  or 


K 


S 


(14) 


which  is  essentially  independent  of  altitude  and  inversely  proportional  to  velocity  as  shown  in  Figure  11. 
Therefore  the  effective  navigation  ratio  can  be  maintained  over  a  wide  altitude  band  even  though  the  aero¬ 
dynamic  data  are  not  well  known.  More  detailed  discussion  of  the  properties  of  this  system  are  given  in 
Ref.  18. 
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Figure  11.  Integrated  Rate  Gyro  Gain  is  Independent  of  Altitude 


Accelerometer  Flight  Control 

When  an  accelerometer  is  added  to  the  missile  and  connected  to  control  the  system  by  the  error 
between  the  acceleration  command  and  the  actual  acceleration,  the  three  loop  flight  control  system  shown 
in  Figure  12  results.  This  system  achieves  dc  gain  control  independent  of  altitude  and  Mach,  and  fast 
response  time  for  both  stable  and  unstable  missiles.  The  transfer  function  from  fin  position  to  accelera¬ 
tion  at  the  accelerometer  location  is  given  by 


k,(ha21s+a 


l+B  j  jS+B 
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(15) 


Note  that  the  zeroes  of  nA  are  slightly  different  than  those  of  because  the  accelerometer  is  not  at  the 
missile  center  of  gravity.  Neglecting  the  rate  gyro,  actuator  and  accelerometer  dynamics,  the  control 
system  transfer  function  can  be  written  as 
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The  control  system  gain.  Kg, 


provides  unity  transmission  when  set  to 


(20) 


Generally  - — —  la  small  compared  to  unity  and  so  the  autopilot  gain,  Kq,  is  Independent  of  both  altitude 
A  M 

and  Mach  number  as  shown  in  Figure  13.  In  other  words,  the  gain  of  this  system  is  quite  robust  to  changes 
in  altitude  and  Mach  number,  or  to  error  in  knowledge  of  the  aerodynamic  coefficients  of  the  missile. 


1 
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Figure  12.  Acceleration  Flight  Control  System 


Figure  13.  Accelerometer  Autopilot  Gain  is  Independent  of  Altitude  and  Kach  Number  Changes 

As  can  be  seen  from  Eq.  (16)  the  dynamic  response  of  the  accelerometer  flight  control  system  is  a 
cubic,  like  the  Integrated  rate  gyro  system.  However,  the  additional  feedback  loop  makes  another  gain 
available  so  that  specified  values  of  time  constant,  damping,  and  cross-over  frequency  can  be  obtained  for 
both  stable  and  unstable  airframes  by  a  proper  combination  of  the  three  gains.  The  time  constant  of  this 
system  is  not  limited  to  values  greater  than  the  missile's  turning  rate  time  constant.  Therefore,  to  first 
order,  the  gain  Kg  determines  the  cross-over  frequency, determines  the  damping  and  determines  the 
time  constant.  Therefore,  the  time  response  of  the  missile  can  be  reduced  to  the  values  needed  to  inter¬ 
cept  high  performance  aircraft  that  may  maneuver  drastically  in  an  effort  to  escape  interception. 


Sumnary  of  Analog  Control  Systems 

The  open  loop  flight  control  system  damping  ratio  and  time  constant  are  that  of  the  airframe  and  are 
therefore  independent  of  the  autopilot  gain,  Kol-  The  low  damping  of  this  flight  control  system  makes  It 
unacceptable  for  radar  homing  applications  due  to  parasitic  attitude  loop  instabilities. 

Some  rate  gyro  flight  control  system  characteristics  are  determined  by  the  autopilot  gain.  Increasing 
the  rate  gyro  gain,  Kr,  Increases  both  the  damping  and  crossover  frequency  of  that  system.  The  maximum 
damping  achievable  Is  determined  by  the  maximum  allowable  crossover  frequency.  The  time  constant  of  this 
system  is  that  of  the  airframe  and  is  therefore  independent  of  autopilot  gain. 
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The  accelerometer  flight  control  system  characteristics  are  controlled  more  completely  by  the  auto¬ 
pilot  gains.  The  rate  loop  gain,  Kr,  determines  the  crossover  frequency,  the  synthetic  stability  gain, 
Wi,  determines  the  damping  while  the  accelerometer  gain,  KAt  determines  the  time  constant.  This  system 
gives  the  designer  most  flexibility  in  setting  the  above  guidance  parameters  independentl'  to  obtain 
optimal  system  performance. 


4.  DIGITAL  FLIGHT  CONTROL 
General 


Digital  autopilots  require  specifications  on  a)  the  system  data  rate,  b)  the  number  of  words,  c)  the 
least  significant  bit,  d)  the  word  length,  e)  the  gain  coefficient  data  rate,  f)  the  transport  lag,  g)  the 
throughput,  and  h)  the  storage.  (Ref.  16,  17)  These  requirements  are  needed  to  specify  the  computer 
architecture  as  well  as  its  dynamic  properties,  such  as  speed  and  memory  capability. 

This  section  of  the  paper  will  develop  the  general  expressions  needed  to  obtain  these  digital  specifi¬ 
cations  from  the  analog  and  digital  properties  desired.  Then  appropriate  numerical  specifications  will  be 
given  for  the  open  loop,  rate  gyro  controlled  and  accelerometer  controlled  systems.  Comparative  figures 
for  performance  requirements  are  generated  by  dividing  the  altitude  and  mach  number  performance  envelope 
into  three  nested  zones  of  progressively  increasing  size.  Zone  1  encompasses  a  low  altitude  and  low  mach 
number  zone.  Zone  2  includes  zone  1  and  extends  the  altitude  and  mach  numbers  to  higher,  but  medium 
ranges.  Zone  3  includes  zone  2  and  extends  the  altitude  and  mach  numbers  to  higher  values.  The  software 
specifications  for  each  zone  are  developed  and  tabulated  in  the  remainder  of  the  paper. 

a)  System  Data  Rate 


The  system  data  rate  is  the  sampling  rate  in  the  signal  dynamic  path.  Signal  sampling  must  be  fast 
enough  to  minimize  aliasing  or  foldover  of  the  frequency  response  in  the  region  of  interest.  This  is  the 
Nyquist  rate  which  is  found  by  doubling  the  frequency  where  the  amplitude  is  20  dB  down  or  more.  For  a 
first  order  system  with  a  break  frequency  of  f0»  the  sampling  frequency  is  then  20  fQ. 

b)  Number  of  Words 

The  number  of  words  required  to  represent  a  zone  is  determined  by  the  dynamic  range  of  the  gains 
required  over  that  zone  and  the  allowable  change  in  gain  from  one  zone  to  another  as  given  by  Eq.  21. 
(Ref.  11) 


\  = 1  + 


log^ 

l°g2r 


(21) 


where 


Ny  is  the  number  of  words  required 

R,  is  the  dynamic  range  of  the  gains,  i.e.  R.  =  K  /K  , 
d  d  max  min 

r  is  the  allowable  ratio  between  adjacent  gains  »  K  K  ^  ^>1 
If  a  10  percent  change  in  gain  is  allowed  by  system  performance,  r  =*  1.1/1  *  1.1. 

c)  Least  Significant  Bit 

The  least  significant  bit  determines  the  accuracy  of  the  control  gain.  It  is  set  from  the  smallest 
gain  needed.  In  missile  control,  the  product  of  the  control  gain,  Ko,  and  the  aerodynamic  gain,  Kj,  is 
the  desired  result  and  guidance  places  an  accuracy  on  this  product,  P,  rather  than  on  either  gain  individ¬ 
ually.  Therefore,  more  control  gain  error  is  allowed  if  the  aerodynamic  gain  is  well  known.  For 
Instance , 


Therefore 


(23) 


where 


AP/P  «  the  total  acceleration  control  uncertainty 
AKq/K0  *  the  control  gain  uncertainty 
AKj/Kj  •  the  aerodynamic  gain  uncertainty 
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For  purposes  of  Che  paper,  allow  10  percent  control  gain  and  10  percent  aerodynamic  gain  uncertainty  to 
yield  20  percent  uncertainty  in  total  acceleration  control.  Then  the  least  significant  bit  (LSB)  is  the 
minimum  value  of  AKo-  It  is  found  from  the  allowable  percentage  error  at  Komin. 


^SB  **  Ko  min 


(24) 


where 


p  «  44K  /K  )  . 

o  o  allowed 

d)  Word  Length 

The  required  word  length  (Ref.  11)  is  determined  from  the  maximum  control  gain  and  the  least  signifi¬ 
cant  bit  as 


WL  -  log2  bits  +  l  sign  bit 


(25) 


where 


WL  is  the  word  length  in  bits 
e)  Gain  Coefficient  Data  Rate 


Data  rate  involves  two  loops,  a  signal  loop  and  a  gain  control  loop,  as  shown  in  Figure  14. 


Figure  14.  Signal  and  Gain  Control  Samplers 

The  sampling  rate  of  the  signal  loop  was  previously  discussed.  The  sampling  rate  of  the  gain  control  loop 
must  be  fast  enough  to  faithfully  represent  the  required  gain  changes  as  the  environment  changes  with 
time. 

The  factors  that  determine  the  gain  path  sampling  rate  are  derived  in  this  section.  A  control  gain 
versus  time  plot  la  shown  in  Figure  15. 
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Figure  15.  Time  Variation  of  Control  Gain 


If  the  sample  interval  At  is  short  enough,  the  control  gain  increment  is 

AK  -  K  At 
o  o 


(26) 
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Therefore 


Eq.  (26)  cone. 
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K 

o 

If  a  fractional  change  (p)  in  K  is  allowed, 


AKo  *  P  Ko 


(27) 


then 


At 


PK„ 


(28) 


For  Ko  only  a  function  of  altitude  and  speed,  the  rate  of  change  of  the  control  gain  is 


3K  .  dK  . 

Ko  '  “a!  v  +  iff  h 


(29) 


where 


V  is  the  missile  velocity 
h  is  the  altitude 

Under  worst-worst  case  assumptions  V  becomes  the  maximum  acceleration  of  the  missile  and  h  becomes  the 
maximum  velocity  of  the  missile. 

Then 


W  -(if) 
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(30) 


Thus,  the  minimum  sampling  interval  for  any  zone  is 


<Ko> 


(At).  -  p 

min  (K  } 


min 


(31) 


The  sampling  interval  obtained  in  this  way  is  the  smallest  necessary  because  the  analysis  uses  worst-worst 
case  assumptions.  When  the  design  reaches  the  simulation  stage,  an  increase  of  this  sampling  interval  may 
by  shown  to  yield  adequate  system  performance  under  more  realistic  conditions  than  the  worst-worst  case 
used  in  the  derivation.  In  addition,  the  percentage  change,  p,  allowed  in  K0,  is  a  direct  factor  In  the 
sampling,  i.e.,  a  40  percent  change  will  allow  twice  the  sampling  interval  that  a  20  percent  change  will 
allow.  Clearly,  the  gain  change  sampling  interval  for  each  gain  in  the  system  will  require  careful  exam¬ 
ination  by  the  design  engineer  to  arrive  at  a  consistent  set  of  rates  for  all  the  system  gains. 

f)  Transport  Lag 


Transport  lag  is  the  dead  time  between  the  time  when  control  measurements  are  taken  and  the  time  when 
control  commands  exit  the  computer.  For  low  bandwidth  control  loops,  transport  lag  may  not  be  a  factor. 
However  as  performance  requirements  become  more  stringent  careful  attention  must  be  paid  to  transport  lag 
to  insure  control  stability.  Computations  must  be  divided  between  a  critical  path  consisting  of  those 
computations  that  can  be  made  only  after  the  measurements  are  taken  and  a  noncritical  path  consisting  of 
computations  that  can  be  performed  based  on  past  data.  For  a  crossover  frequency  of  80  rad/sec  a  time 
delay  of  1  msec  will  give  a  phase  lag,  6,  of 
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1000 


80  mrad  or  4.6° 


(32) 


Clearly  the  transport  lag  is  a  significant  factor  in  the  system  phase  margin  and  stability, 
g)  Throughput 

The  throughput  required  is  determined  by  the  number  of  operations  (adds,  multiplies,  data  transfers, 
etc.)  required  per  second.  An  estimate  of  the  throughput  required  can  be  obtained  prior  to  actually 
writing  the  computer  program  from  count  of  arithmetic  operations.  Many  times  this  count  is  reduced  to  an 
equivalent  number  of  adds  per  second.  After  programming,  it  is  only  necessary  to  count  the  operations  and 
average  over  the  appropriate  time. 
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h)  Storage  Required 

The  storage  required  for  the  control  gains  depends  upon  whether  all  the  gains  are  stored  and  retrieved 
or  whether  a  few  are  stored  and  the  exact  gain  obtained  from  interpolation.  Interpolation  routines  trade 
throughput  for  storage  and  the  proper  choice  of  any  system  depends  upon  the  hardware  that  can  be  made 
available  for  that  system.  For  the  paper,  assume  all  the  gains  are  stored.  Then  the  amount  of  storage 
required  is 

c  u  (33) 

SR  _  WL  x  "w  x  NG 


N  *  number  of  gains  stored. 

(j 

”  word  length  in  bits. 

N  »  number  of  words. 


SR  »  amount  of  storage  required  in  bits. 


Open  Loop  Control 

The  set  of  gains,  K ,  used  for  the  open  loop  calculations  at  the  zone  boundaries  are  listed  in 
Table  1.  (Ref.  18).  0L 

Table  1 

Open  Loop  Control  Gains 


Zone  1 

Zone  2 

Zone  3 

Speed 

Low 

Low 

1 

1 

Med 

1 

High 

Altitude  ^ 

A 

B 

1 

C 

1 

D 

Low  A 

1.77 

0.198 

1 

1 

0.117 

1 

0.0775 

Low  B 

2.57 

0.287 

l 

1 

—  -J 

0.170 

1 

1 

0.112 

Med  C 

4.70 

0.521 

0.307 

1 

_ 1 

0.204 

High  D 

15.24 

1.68 

1.00 

0.662 

The  dotted  lines  show  the  division  into  zones  that  are  used  for  comparisons  of  specifications  as  the  range 
of  flight  conditions  expands. 

a)  The  System  Data  Rate 

The  allowable  system  data  rate  depends  fundamentally  on  the  frequency  of  aerodynamic  short  period  mode 
(f d)  and  on  the  structural  resonance  frequency.  For  an  open  loop  control  application,  the  structural 
resonance  is  usually  attenuated  enough  by  the  actuator  so  only  the  aerodynamic  frequency  is  significant. 

A  sampling  frequency  of  20  fj  is  sufficiently  larger  than  the  Nyquist  frequency  to  achieve  a  control  band¬ 
width  consistent  with  the  missile  aerodynamics.  For  each  zone,  the  aerodynamic  frequency,  the  sampling 
frequency,  and  the  time  between  samples  is  shown  in  Table  2. 

Table  2 

Open  Loop  Sampling  Requirements 


Zone 

Sampling 

^Requirement 

Highest 

Aerodynamic  Frequency 
fd(Hz) 

Sampling 

Frequency 

fs(Hz) 

Sampling 

Interval 

T 

s 

(millisec) 

Zone 

1 

2.81 

56.3 

17.75 

Zone 

2 

4.09 

81.8 

12.2 

Zone 

3 

5.34 

106.9 

9.35 

Note  that  the  sampling  Interval  decreases  as  the  zone  coverage  gets  to  higher  speeds. 
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b)  Number  of  Words 

From  Eq.  (21)  and  the  open  loop  gains  of  Table  1 


Zone  1  Rjj  -  K°L  —  -  2.57/0.198  -  12.98 


OL  min 

r  -  1.10  for  a  10  percent  level  change 


"w 


1  + 


l°g2Rd 


1  + 


log2  12.98 


log2r  *  '  log2  1.10 


-  1  +  26.:*  -  27.9, 


Ny  -  28  words 

Zone  2  Rj  -  4.70/0.117  -  40.1,  Ny  -►  40  words 
Zone  3  Rj  -  15.2/0.0775  -  196,  1^  -*■  57  words 

Note  that  the  number  of  words  needed  to  represent  the  gains  increases  dramatically  as  the  zone  coverage 
expands. 


c)  Least  Significant  Bit 

The  open  loop  control  gain  only  affects  the  effective  navigation  ratio.  Miss  distance  data  previously 
presented  shows  that  N'  can  vary  by  ±20  percent.  If  we  assume  10  percent  uncertainty  in  the  fixed  aero¬ 
dynamic  gain,  then  the  control  gain  can  have  a  10  percent  error.  Then  from  Eq.  (24)  LSB  »  p  K,,,  - 

0. 1  K  for  each  zone  ^mln 

OL  min 

Zone  1  Zone  2  Zone  3 

LSB  0.0198  0.0117  0.00775 


d)  Word  Length  ; 

For  each  zone  the  word  length  can  be  found  from  Eq.  (25).  The  open  loop  word  length  requirements  are 
calculated  using  the  information  from  this  formula  and  tables  and  LSB. 

.Zone  1  •  log2  (2.57/0.0198)  +1-8  bits 

Zone  2  WL  -  log2  (2.69/0.0117)  +1-10  bits 
Zone  3  WL  -  log2  (15.2/0.00775)  +1-12  bits 


As  the  zone  Increases  in  coverage  the  word  length  must  be  increased, 
e)  Gain  Coefficient  Data  Rate 


For  an  allowable  control  gain  change  of  10  percent,  the  minimum  sampling  interval  is  independent  of 
zone  for  the  cases  considered  here. 

^Omin  “  19.2  msec  for  all  zones 
f)  Transport  Lag 

The  homing  loop  is  the  only  closed  loop  in  the  open  loop  control  system.  Bandwidth  and  crossover 
frequencies  are  not  a  meaningful  measure  of  the  homing  loop  because  that  loop  dynamics  varies  with  range 
from  the  missile  to  target.  A  rule  of  thumb  in  this  case  is  that  the  transport  lag  should  be  less  than  one 
third  of  the  sampling  interval. 

Zone  1  Zone  2  Zone  3 

Transport  Lag  5.92  4.07  3.12 

(msec) 


!  g)  Throughput 

The  open  loop  control  is  a  simple  multiply  in  each  axis.  For  comparative  purposes,  we  only  consider  a 
single  axis  and  neglect  Instructions  like  fetch  from  store.  Then  we  get  one  multiply  required  per  sample 
Interval.  If  we  say  a  multiply  is  the  equivalent  of  10  additions  and  we  define  an  addition  as  an  operation 


Tp  -  10/Tg  operatlons/sec  Per  axis 


k 


6 


and  the  throughput  requirements  can  be  calculated  using  the  Information  from  Table  2. 

Zone  1  T  “  10/0.01775  -  563  ops/sec/axis 
-  P 

Zone  2  «  10/0.0122  «  820  ops/sec/axis 

Zone  3  Tp  -  10/0.00935  ■  1070  ops/sec/axis 

Note  the  expansion  of  throughput  required  as  the  aerodynamic  zone  expands, 
h)  Storage 

For  a  system  where  all  the  gains  are  stored  and  there  Is  1  gain  per  axis  (Ng  •  1),  Sr  -  Ny  in  words  or 
Sr  ~  Nu  x  in  bits  Eq.  (33).  Then  for  each  zone,  the  storage  required  is  obtained  from  Sections  b)  and 
d)  and  is 

Zone  1  S^  ■  28  words  x  8  bits/word  ■  280  bits 

Zone  2  S^  -  40  words  x  10  bits/word  ■  400  bits 

Zone  3  S^  *  57  words  x  12  bits/word  -  570  bits 

The  number  of  bits  required  can  be  calculated  using  the  word  length  specifications  as  above  or  a  fixed 

number  of  bits  per  word  if  the  machine  is  already  chosen. 

Summary  of  Open  Loop  Digital  Control  Specifications 


The  open  loop  digital  control  specifications  are  summarized  in  Table  3. 

Table  3 

Summary  of  Open  Loop  Digital  Control  Specifications 


Parameter 

Zone  1 

Zone  2 

Zone  3 

a) 

System  Data  Interval  (msec) 

17.75 

12.2 

9.35 

b) 

Number  of  Words  (words/axls) 

28 

40 

57 

c) 

Least  Significant  Bit 

0. 01 98 

0.0117 

0.00775 

d) 

Word  Length  (Bits) 

8 

10 

12 

e) 

Gain  Coefficient  Data 

Interval  (msec) 

19.2 

19.2 

19.2 

f> 

Transport  Lag  (msec) 

5.9 

4.1 

3. 1 

g) 

Throughput  (ops/sec/axls) 

563 

820 

1070 

h) 

Storage  (bits/axis) 

280 

400 

570 

Gyro. 

Control 

The  basic  rate  gyro  control  system  has  two  gains,  the  rate  loop  gain  and  the  control  gain.  The  rate 
loop  gain  Kr  sets  the  damping  and  the  control  gain,  K,  sets  the  effective  navigation  ratio.  Therefore 
specifications  must  be  set  on  each  of  these  gains.  The  set  of  gains  used  for  these  calculations  at  the 
zone  boundaries  are  listed  in  Table  4  and  Table  5. 

Table  4 


Rate  Loop  Gains  for  Rate  Gyro  Control  System 
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Table  5 


Control  Gain  for  Rate  Gyro  Control  System 


With  two  gain  and  two  signal  paths,  the  rate  gyro  system  requires  twice  the  number  of  specifications  as 
the  open  loop  system.  Specifications  on  each  are  presented  in  the  same  order  as  in  the  open  loop 
discussion. 

a)  System  Data  Rate 

The  rate  loop  contains  both  the  aerodynamic  short  period  frequency  and  the  structural  resonance 
frequency  as  seen  by  the  gyro.  The  rate  gyro  loop  sampling  rate  must  be  at  least  twenty  times  the  cross¬ 
over  frequency  loop.  If  the  structural  frequency  is  low  enough  and  its  damping  is  small  enough,  it  will 
govern  the  sampling  rate.  For  our  purposes,  we  let  the  crossover  frequency  govern,  then  the  sampling 
frequencies  are  those  in  Table  6. 

Table  6 


Rate  Gyro  Sampling  Requirements 


Zone 

Sampling 

Highest  Crossover 
Frequency (Hz) 

Sampling  Frequency 
(Hz) 

Sampling  Interval 
(msec) 

Zone  1 

3.4 

68 

14.7 

Zone  2 

4.1 

102 

9.8 

Zone  3 

6.7 

134 

7.5 

The  control  signal  path  is  very  similar  since  its  bandwidth  is  the  closed  rate  gyro  loop  which  is  approx¬ 
imately  equal  to  the  crossover  frequency.  In  this  example  the  sampling  rate  requirements  are  similar  for 
both  the  open  loop  and  rate  gyro  systems  because  of  the  similarity  of  the  highest  crossover  frequencies. 

b)  Number  of  Words 


The  number  of  words  for  each  gain  table  and  a  10  percent  gain  ratio  can  be  calculated  from  Eq.  (21)  and 
Tables  4  and  5.  The  word  requirements  for  each  gain  are  tabulated  below. 

Table  7 

Word  Requirements  for  Rate  Gyro  Autopilot 


Rate 

Gain 

Control 

Gain 

*d 

Nw 

rd 

Nw 

Zone 

i 

2.47 

11 

4.72 

18 

Zone 

2 

3.80 

15 

9.32 

25 

Zone 

3 

6.89 

22 

24.6 

35 

c)  Least  Significant  Bit 

The  least  significant  bit  is  10  percent  of  the  smallest  control  gain  as  previously  described.  However 
the  rate  gain  affects  the  damping  which  can  be  allowed  to  vary  50  percent.  Since  the  damping  is  propor¬ 
tional  to  the  product  of  the  rate  gain  and  an  aerodynamic  gain  which  can  be  uncertain  by  10  percent,  the 
rate  gain  can  be  uncertain  by  40  percent.  Therefore  the  rate  loop  gain  LSB  is  40  percent  of  the  smallest 
rate  loop  gain.  Using  Eq.  (24)  and  the  information  from  Tables  4  and  5  we  can  arrive  at  the  requirement. 


For  each  zone  and  each  gain  Che  word  length  la  obtained  from  Eq.  (25)  and  is  tabulated  below. 


Table  9 

Word  Length  Requirements  for  Rate  Gyro  Autopilot 


Rate  Gain 
(bits) 

Control  Gain 
(bits) 

Zone  1 

3.63—4 

6.56—7 

Zone  2 

4.25  —  5 

7.54  —  8 

Zone  3 

5.09  —6 

8.94  —9 

Note  that  chese  word  lengths  are  much  smaller  than  those  of  the  open  loop  control  gains  bee  .use  of  the 
smaller  gain  variations.  The  difference  in  word  length  requirements  between  the  gains  of  this  autopilot 
are  due  to  differences  in  allowable  uncertainties  in  the  gain  themselves. 

e)  Gain  Coefficient  Data  Rate 


For  an  allowable  control  gain  change  of  10  percent  and  rate  loop  gain  change  of  40  percent,  the  gain 
coefficient  sample  intervals  are  calculated  from  Eq.  (30)  and  (31)  and  Tables  4  and  5.  The  data  rate 
requirement  is  shown  below. 


Table  10 


Gain  Coefficient  Data  Rate  Requirements  for  Rate  Gyro  Autopilot 


<*>min 

(msec) 

Rate  Gain 

Control  Gain 

Zone  1 

575 

49.1 

Zone  2 

575 

47.4 

Zone  3 

575 

34.8 

Note  that  both  of  these  sample  intervals  are  substantially  less  than  those  for  the  open  loop  system.  The 
differences  in  requirements  for  both  systems  is  due  to  gain  variations  and  allowable  uncertainties  in  the 
gains  themselves. 


f)  Transport  Lag 


The  transport  lag  mainly  affects  the  stability  of  the  rate  loop.  If  we  allow  3  deg  (0.0524  rad) 
phase  lag  at  the  highest  crossover  frequency  in  each  zone,  we  get  from  Eq.  (32) 


CR 


0.0523 

GJ 

CR 


(37) 


for  the  rate  gain  calculation.  Note  that Wcg  is  determined  by  the  rate  gain.  The  control  gain  calculation 
is  similar.  Table  11  can  be  generated  by  utilizing  the  above  formula  with  the  information  from  Table  6. 

Table  II 


Transport  Lag  Requirements  for  Rate  Gyro  System 
Transport  Lag  (msec) 


g)  Throughput 

The  rate  gyro  system  requires  two  multiplies  and  an  addition  to  compute  the  control  commands.  This  is 
21  operations  per  sampling  interval  per  axis.  Therefore  the  operations  rate  is  21/T-  per  axis  as  listed 
below  for  each  zone.  s 


Throughput 


Zone 

i 

1428 

ops/sec/axis 

Zone 

2 

2142 

ops/sec/axis 

Zone 

3 

2800 

ops/sec/axls 

h)  Storage 


The  storage  is  calculated  from  the  sum  of  the  rate  words  and  the  control  words.  Since  each  of  these 
words  requires  a  different  number  of  bits,  this  calculation  is  weighted  to  get  bits/axis.  Combining  the 
information  from  Tables  7  and  9,  we  get 

Zone  1  SR  ■  11  x  4  +  18  x  7  »  170  bits/axis 

Zone  2  SR  ■  15  x  5  +  25  x  8  «  275  bits/axis 

Zone  3  SR  *  22  x  6  +  35  x  9  *  447  bits/axis 

Of  course,  if  the  words  cannot  be  packed,  the  storage  required  will  increase  as 
Zone  1  SR  -  7  x  (11  +  18)  •  203  bits/axis 

Zone  2  SR  •  8  x  (15  +  25)  -  320  bits/axis 

Zone  3  SR  *  9  x  (22  +  35)  *  513  bits/axis 

Thus  if  the  data  can  be  packed  the  storage  requirements  for  the  rate  gyro  system  is  somewhat  less  than  for 
the  open  loop  system.  If  the  data  cannot  be  packed  the  storage  requirements  are  about  the  same.  The 
smaller  number  of  bits  and  required  number  of  words  of  the  rate  gyro-system  compensate  for  the  extra  gain. 

Summary  of  Rate  Loop  Digital  Control  Specifications 


The  rate  loop  digital  control  specifications  are  summarized  in  Table  12. 

Table  12 

Summary-Rate  Gyro  Digital  Control  Specifications 


Zone  1 

Zone  2 

Zone  3 

Rate 

Gain 

Control 

Gain 

Rate 

Gain 

Control 

Gain 

Rate 

Gain 

Control 

Gain 

a) 

System  Data  Interval 
(msec) 

14.7 

9.8 

7.5 

b) 

Number  of  Words 
(words/axis) 

ii 

18 

15 

25 

22 

35 

c) 

Least  Significant 

Bit 

0.0186 

0.51 

0.0165 

0.34 

0.0138 

0.27 

d) 

Word  Lengths  (Bits) 

4 

7 

5 

8 

6 

9 

e) 

Gain  Coefficient 

Data  Interval 
(msec) 

575 

49 

575 

47 

575 

35 

n 

Transport  Lag 
(msec) 

2.45 

1.65 

1.24 

g) 

Throughput , 

(op/ sec/a/is) 

1428 

2142 

2800 

h) 

Storage  (bit/axis) 

170 

275 

447 

-  packed 

-  unpacked 

203 

320 

513 

Accelerometer  Control 


A  representative  three  loop  accelerometer  control  system  having  a  time  constant  of  0.3  sec,  a  cross¬ 
over  frequency  of  50  rad/sec,  and  a  damping  ratio  of  0.7  is  used  to  derive  digital  requirements.  This 
system  has  four  gains  -  the  rate  loop  gain  (Kg),  the  synthetic  stability  gain  fcoj),  the  acceleration  gain 
(rA>>  an<*  control  gain  (Kq)  .  The  gains  used  at  the  zone  boundaries  are  tabulated  in  Table  13. 
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Table  13 


Accelerometer  Control  System  Gains 


Accelerometer  Gain 
*A 


Zone  1 


Zone  2 


Synthetic  Stability  Gain 
“i 


Zone  1 


Zone  2 


Zone  3 


Speed 

Altitude  X. 

Low  A 

Low  B 

- 1 

1 

1 

| 

Med  C 

r~ 

1 

1 

1 

High  D 

Low  A 

4.344 

0.  3879 

1 

t 

0.2829 

1 

0.7431 

Low  B 

6.484 

0.7316 

1 

_  J 

0.3828 

1 

i 

0.4597 

Med  C 

12.34 

1.706 

0.7795 

1 

0.5788 

High  D 

41.84 

6.768 

- • 

3. 128 

_ 1 

1.969 

Zone  3 


Speed 

Altitude 

Low  A 

Low  B 

T" 

1 

i 

Med  C 

1 

1 

1 

. 1 

High  D 

Low  A 

21.28 

22.13 

i 

16.23 

1 

7.617 

Low  B 

20.77 

22.89 

i 

j 

18.93 

t 

1 

13.14 

Med  C 

18.86 

23.28 

21.63 

1 

18.53 

High  D 

12.36 

21.30 

22.55 

_ 1 

22.27 

Rate  Loop  Gain 


Kr 

Zone  1 

Zone  2 

Zone  3 

Speed 

A  i  t  i  t  ude 

Low  A 

Low  B 

t 

1 

1 

Med  C 

1 

1 

1 

-1 

High  D 

Low  A 

0.2923 

0.1096 

I 

1 

0.06520 

1 

0.0408 

Low  B 

0.4467 

0.1609 

1 

_ 1 

0.09492 

1 

| 

0.0594 

Med  C 

0.9181 

0 . 2999 

0.1758 

1 

0.1093 

High  D 

4.927 

1.108 

0.6098 

0  .  3698 

Control  Gain 


K„  Zone  1  Zone  2  Zone  3 


Speed 

Altitude^''^'---^^ 

Low  A 

Low  B 

- 1 - 

1 

1 

Med  C 

- 1 - 

1 

1 

1 

High  0 

Low  A 

1.381 

3.131 

1 

| 

2.948 

1 

1.556 

Low  B 

1.264 

2.171 

1 

_ 1 

2.492 

1 

| 

1.932 

Med  C 

1.147 

1.532 

1.777 

1 

1.784 

High  D 

1.045 

1.140 

-  -  — 

1.202 

_ 1 

1.241 

In  this  control  system  the  rate  loop  gain  (Kr)  sets  the  crossover  frequency,  the  synthetic  stability 
gain  iJj)  sets  the  damping,  the  acceleration  gain  (Kg)  influences  the  time  constant  and  the  control  gain 
(K0)  sets  the  effective  navigation  ratio.  As  with  the  other  flight  control  systems,  specifications  roust 
be  set  on  each  of  the  four  gains.  Specifications  on  each  of  the  gains  are  discussed  in  the  same  order 
as  with  the  other  flight  control  systems.  It  should  be  noted  that  a  different  analog  time  constant, 
damping,  or  crossover  frequency  gives  a  different  set  of  gains  which,  in  turn,  would  give  a  different  set 
of  digital  specifications.  Therefore  an  analog-digital  trade  off  exists  which  can  be  used  to  meet  digital 
hardware  or  software  constraints. 


22-21 


a)  System  Data  Rate 

As  with  the  other  flight  control  systems  the  crossover  frequency  of  each  of  the  loops  governs  the 
sampling  frequency.  Using  the  rule  of  thumb  that  the  loop  sampling  rate  must  be  at  least  twenty  times  the 
crossover  frequency  we  derive  the  following  sampling  requirements  for  the  accelerometer  flight  control 
system  in  all  3  zones. 


Table  14 


Accelerometer  System  Data  Rate  Requirement  in  All  Zones 


Gain 

Highest 

Crossover  Frequency  (Hz) 

Sampling 
Frequency  (Hz) 

Sampling 

Interval 

(msec) 

Kr 

7.96 

159.2 

6.28 

“I 

1.91 

38.2 

26.2 

ka 

0.478 

9.56 

105 

K 

o 

0.478 

9.56 

105 

b )  Number  of  Words 


Using  the  gains  in  Table  13,  the  number  of  words  required  in  each  zone  are  shown  in  Table  15. 

Table  15 

Number  of  Words  for  Accelerometer  Control 


ka 

S 

Nw 

Cl) 

*D 

I 

Nw 

kr 

% 

Nw 

K 

*D 

0 

Nw 

Zone 

1 

16.7 

31 

1.1 

2 

4.07 

16 

2.48 

li 

Zone 

2 

43.6 

42 

2.4 

5 

14.2 

29 

2.  73 

12 

Zone 

3 

148 

54 

1.9 

8 

120 

52 

3.00 

13 

c)  Least  Significant  Bit 


The  control  gain  and  rate  gain  can  only  be  allowed  to  vary  20  percent  because  the  navigation  ratio 
and  crossover  frequency  can  only  be  allowed  to  vary  10  percent.  Since  the  damping  can  be  allowed  to  vary 
40  percent  (as  with  the  rate  gyro  system)  the  synthetic  stability  gain  can  also  vary  by  that  amount.  For 
capability  against  high  performance  targets  the  time  constant  and  therefore  the  acceleration  gain  can  not 
be  allowed  to  vary  by  more  than  50  percent.  Using  Eq.  (24)  and  the  data  from  Table  13  give  rise  to  the 
following  table. 


Table  16 

Least  Significant  Bit  for  Accelerometer  Gains 


ka 

(r  ->  50%) 

U1 

( t  -  40%) 

*12 

*-CR  '  10%) 

K 

o 

(N'  -*•  10%) 

Zone  1  0.1 94 

8.31 

0.0110 

0. 126 

Zone  2  0.141 

6.49 

0.00652 

0.115 

Zone  3  0.141 

3.05 

0.000409 

0. 105 

d)  Word  Length 

Using  the  LSB  data  from  Table  16,  the  information  from  Table  13  and  Eq.  (25)  yields  the  following 
word  length  requirements  in  Table  17. 
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Table  17 


Word  Length  Requirements-Accelerometer  Control 


ka 

"i 

*8 

K 

o 

Zone  1 

7 

3 

7 

6 

Zone  2 

8 

3 

9 

6 

Zone  3 

10 

4 

15 

6 

The  least  stringent  requirements  in  word  length  are  for  the  synthetic  stability  gain.  The  require¬ 
ment  is  relaxed  because  this  quantity  does  not  vary  widely  with  mach  and  altitude  and  we  can  allow  a 
40  percent  variation  in  this  gain.  The  control  gain  requirement  is  more  stringent  mainly  because  we  are 
allowing  only  a  10  percent  variation  on  the  gain.  The  fact  that  this  gain  varies  only  slightly  over  the 
entire  mach-altitude  regime  prevents  the  word  length  requirement  on  the  gain  from  being  more  stringent. 
The  accelerometer  gain  requirements  are  stringent  because  of  the  wide  dynamic  range  of  this  gain.  The 
most  stringent  requirements  are  on  the  rate  gain  because  of  its  wide  dynamic  range  and  the  10  percent 
constraint  on  its  variability. 

e)  Gain  Coefficient  Data  Interval 


The  accelerometer  gains  in  Table  13  were  used  with  Eq.  31  to  develop  the  minimum  data  interval  at 
which  the  gains  need  to  be  changed. 


Table  18 

Gain  Coefficient  Data  Interval-Accelerometer  Control 


(At)min 

(msec) 

ka 

(p  -  50Z) 

«1 

(p  -  40Z) 

(p  -  10*) 

K 

o 

(p  *  102) 

Zone  1 

74 

5860 

83 

122 

Zone  2 

74 

1408 

72 

122 

Zone  3 

74 

392 

44 

122 

f )  Transport  Lag 

The  transport  lag  that  gives  a  phase  lag  of  3  deg  in  its  signal  path  is  found  as  follows. 
Rate  Path  r.  -  -f-  -  0.0524/50  -  0.00105  sec 


Synthetic  Stability  j-d  -  0.0524/12  -  0.00437  sec 

Accelerometer  and  Control  Gain  r,  *  0.0524/3  »  0.0175  sec 

d 

Note  that  the  rate  path  is  the  most  stringent  and  it's  still  about  a  millisecond,  the  same  as  for  the  rate 
gyro  system. 

g)  Throughput 

The  throughput  is  calculated  from  the  operations  required  to  compute  the  control  command.  These  are 
four  multiplies,  one  for  each  gain,  and  three  addition,  one  after  each  multiply  except  the  last.  The 
equations  are: 

CO  -  acceleration  command 

A  »  K  x  CO  +  Accel  at  159.2  Hz 
o 

B  -  Ka  x  A  +  Gyro  at  38.2  Hz 
C  -  tUj  x  B  +  Gyro  at  9.56  Hz 
D  ■  Kjj  x  C  at  9.56  Hz 


As  before,  we  weight  a  multiply  as  10  adds,  then  each  of  the  four  equations  is  11  add9  or  operation. 
Weighting  each  by  its  frequency  of  occurrence  gives  an  operations  throughput  requirement  of  2381  operations/ 
second. 


L 
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h)  Storage 


The  storage  required  increases  with  zone.  If  the  words  are  packed,  then  Eq.  (33)  is  applied  to  each  gain 
and  the  results  are  summed  to  get  the  storage  for  each  zone,  as  follows 

Zone  l ,  SR  ■  31x7  +  2x3  +  16x7  +  11x6  -  401  bits 

2one  2,  SR  -  41x8  +  5x3  +  29x9  +  12x6  *  676  bits 

Zone  3,  SR  *  54x10  +  8x4  +  52x15  +  13x6  *  1430  bits 

If  the  word  lengths  are  held  constant  at  the  maximum  word  length,  i.e.,  packing  is  not  possible,  then  Che 
calculations  change  as  follows, 

Zone  1 ,  SR  *  7x(31+2+16+l 1)  *  420  bits 

Zone  2,  SR  -  9x (4 1+5+2*4-12)  *  783  bits 

Zone  3,  SR  -  15x (54+8+52+1 3)  -  1905  bits 


In  either  case  the  numbers  are  not  much  different. 


Software  Comparisons 

A  comparison  of  software  specifications  for  the  open  loop,  rate  gyro  controlled,  and  accelerometer  con¬ 
trolled  system  is  shown  in  Table  19.  The  open  loop  system  is  not  usable  for  radar  guidance  so  it  really 
can't  be  compared  with  the  others.  However,  both  the  rate  gyro  and  the  accelerometer  system  can  be  used 
for  radar  guidance  and  the  table  reveals  many  interesting  comparisons.  First  note  that  the  transport  lag 
and  throughput  of  the  rate  gyro  system  is  very  sensitive  to  the  zone  size,  but  the  transport  lag  and 
throughput  of  the  accelerometer  system  are  independent  of  zone  size.  Both  systems  require  more  storage 
as  zone  size  increases  with  the  accelerometer  system  requiring  more  storage.  A  close  look  at  the  through¬ 
put  shows  that  for  Zone  1,  the  low  altitude,  low  speed  zone,  the  rate  gyro  system  requires  less  through¬ 
put  than  the  accelerometer  system.  However,  for  Zone  2,  the  medium  altitude,  medium  speed  zone,  the 
throughputs  are  about  the  same,  and  for  Zone  3,  the  zone  that  covers  all  altitudes  and  speeds,  the  accel¬ 
erometer  system  requires  less  throughput  than  the  rate  gyro.  Clearly  as  the  performance  envelope  grows, 
the  additional  hardware  of  the  accelerometer  system  is  reducing  throughput  requirements.  Nevertheless, 
the  accelerometer  system  always  requires  more  storage.  If  this  poses  a  problem,  algorithms  for  interpolation 
and  extrapolation  of  the  gains  can  be  used  to  trade-off  storage  for  throughput. 

It  must  be  remembered  that  the  sample  calculations  shown  in  this  paper  do  not  cover  all  of  the 
trade-offs  possible.  The  rate  gyro  gains  were  based  on  achieving  a  given  damping  ratio  within  a  pre¬ 
scribed  accuracy.  Change  these  numbers  and  the  requirements  change.  Likewise  the  accelerometer  gains 
are  based  on  achieving  a  certain  time  constant,  damping  ratio,  and  crossover  frequency  within  a  pre¬ 
scribed  tolerance  for  each  of  these  parameters.  Change  them,  the  gains  change  and  so  do  the  digital 
requirements.  A  complete  set  of  trade-offs  can  be  run  using  computer  programs  that  do  all  the  calcu¬ 
lations  required  over  the  region  of  application  of  the  guided  missile  system  to  be  designed. 
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Table  19 


Comparison  of  Digital  Control  Specifications 


Open 

Loop 

Rate 

Gyro 

K 

0 

Accelerometer 

ka 

kol 

K 

kr 

wi 

s 

a)  System  Data 

Interval  (ms) 

Zone  #1 

17.75 

14.7 

14.7 

105 

26.2 

6.28 

105 

02 

12.2 

19.8 

9.8 

105 

26.2 

6.28 

105 

03 

9.35 

7.5 

7.5 

105 

26.2 

6.28 

105 

b)  Number  of  Words 

(words /axis) 

fl 

28 

18 

11 

11 

2 

16 

31 

#2 

40 

25 

15 

12 

5 

29 

41 

#3 

57 

35 

22 

13 

8 

52 

54 

c)  Least 

Significant  Bit 

#1 

0.0198 

0.51 

0.0186 

0.26 

8.31 

0.011 

0.194 

#2 

0.0117 

0.34 

0.0165 

0.115 

6.49 

0.00652 

0.141 

#3 

0.00775 

0.27 

0.0138 

0.105 

3.05 

0.000409 

0.141 

d)  Word  Length 

(Bits) 

#1 

8 

7 

4 

6 

3 

7 

7 

#2 

10 

8 

5 

6 

3 

9 

8 

#3 

12 

9 

6 

6 

4 

15 

9 

e)  Gain  Coefficient 

Data  Interval 

(ns) 

| 

#1 

19.2 

49 

1 

575 

122 

5860 

83 

74 

02 

19.2 

47 

575 

122 

1408 

72 

74 

03 

19.2 

35 

575 

122 

392 

44 

74 

f)  Transport  Lag 

(ms) 

*1 

5.9 

2.45 

17.5 

4.37 

1.05 

17.5 

#2 

4.1 

1.65 

17.5 

4.37 

1.05 

17.5 

#3 

3. 1 

1.24 

17.5 

4.37 

1.05 

17.5 

g)  Throughput 

(op/sec/axis) 

H 

563 

1428 

2381 

02 

820 

2142 

2381 

03 

1070 

2800 

2381 

h)  Storage 

#i 

280 

170 

401 

packed  #2 

400 

275 

676 

#3 

570 

447 

1430 

unpacked  #1 

280 

252 

420 

12 

400 

400 

783 

#3 

570 

630 

1905 
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CONCLUSIONS 


This  paper  makes  comparisons  of  the  hardware-software  considerations  both  in  terms  of  performance 
and  requirements  for  major  flight  control  systems.  The  Instrumentation  chosen  influences  guidance 
parameters  -  effective  navigation  ratio*  damping  and  response  time.  The  instrumentation  chosen  also 
influences  on-board  computer  sizing  requirements.  A  proper  choice  of  both  hardware  and  software 
specifications  is  needed  to  minimize  cost. 

It  is  shown  that  the  open  loop  system  yields  an  effective  navigation  ratio  that  depends  upon  both 
altitude  and  speed.  Its  response  is  that  of  the  airframe  and  its  damping  is  so  low  that  the  system  is 
not  usable  for  radar  homing  against  aircraft  targets.  Although  the  computer  throughput  and  storage 
requirements  for  this  system  are  minimal,  large  word  lengths  are  required  to  make  the  system  work  over 
a  large  altitude  -  speed  space. 

The  rate  gyro  system  improves  the  low  damping  ratio  of  the  airframe  but  cannot  always  stabilize 
an  unstable  airframe.  The  computer  throughput  and  storage  requirements  are  about  the  same  as  the  open 
loop  system,  but  the  word  length  requirements  are  less  stringent. 

The  accelerometer  flight  control  system  removes  the  speed  -  altitude  dependence  of  the  effective 
navigation  ratio,  has  good  damping,  short  response  time  and  can  stabilize  an  unstable  airframe.  The 
software  penalty  for  the  improved  performance  is  signif leant ly  larger  computer  throughput  and  storage 
requirements  and  word  lengths  slightly  greater  than  the  open  loop  system  for  Zone  1,  the  small  zone. 
However,  if  it  is  necessary  to  cover  a  large  altitude-speed  space,  the  throughput  requirements  of  the 
accelerometer  system  are  smaller  than  those  of  the  simpler  gyro  system. 

The  techniques  presented  in  this  paper  show  some  of  the  important  steps  which  must  be  taken  to 
determine  the  hardware  and  software  required  for  a  particular  guided  missile  flight  control  application. 
Both  the  hardware  and  software  requirements  have  profound  influence  on  cost  and  performance,  and  both 
must  be  properly  specified  to  obtain  optimum  performance  at  minimum  cost. 
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SUMMARY 

Highly  integrated  guidance  and  control  systems  promise  improvements  in  mission  performance  and 
fault  tolerance,  but  there  is  an  attendant  requirement  for  centralizing  at  least  portions  of  the  compu¬ 
ting  system  resource.  The  resulting  combined  centralized/distributed  or  hierarchical  architectures 
present  system  designers  with  challenges,  such  as  assuring  that  adequate  margins  are  allowed  for  pro¬ 
cessing  nodes  and  communicat ions  links  throughout  the  system.  Few  tools  exist  for  analyzing  and  vali¬ 
dating  these  complex  computing  system  architectures  in  their  early  development  stages.  This  paper 
highlights  the  importance  of  early  and  sustained  validation  of  architectures  for  highly  integrated  sys¬ 
tems,  and  focuses  on  two  early  validation  tools  developed  by  Systems  Control  in  its  project  work.  A 
description  of  the  two  tools,  1)  Generalized  Reliability  and  Maintainability  Program  (GRAMP),  and  2) 
Functional  Emulation,  is  presented,  along  with  a  discussion  of  their  utility  in  the  development  of 
highly  integrated  guidance  and  control  systems. 


INTRODUCTION 

Increasingly  sophist icated  military  operations  require  correspondingly  more  capable  and  reliable 
airborne  systems  for  avionics,  weapons  management,  and  control  of  flight.  The  need  for  coordination 
among  airborne  systems  and  the  potential  for  performance  improvements  by  addressing  combined  perfor¬ 
mance  objectives  have  spurred  the  exploration  of  functional  integration  (e.g.,  integrated  fire/flight 
control,  integrated  flight/  trajectory  control,  integrated  f light/propulsion  control).  The  importance 
of  such  highly  integrated  systems  to  mission  success  and  survivability  has  elevated  the  reliability 
requirements  of  traditional  "outer-loop"  functions  (navigation,  guidance,  C^)  to  a  level  where  they 
rival  those  of  flight  control  for  tolerance  to  faults. 

Expected  Benefits  of  Integration 

Figure  1  illustrates  some  of  the  expected  benefits  of  the  moment  toward  highly  integrated  guidance 
and  control  systems.  Among  these  are: 
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EXPECTED  BENEFITS 


IMPROVED  PILOT  AND  C3I 
INTERFACE 


IMPROVED  MISSION 
PERFORMANCE  AND 
SURVIVABILITY 


IMPROVED  RELIABILITY  AND  | 
AFFORDABILITY 


IMPLICATIONS 

•  PILOT  AS  A  MISSION 
MANAGER 

-  INFORMATION  FUSION 

•  FUNCTIONAL  INTEGRATION 
CONCEPTS 

—  INTEGRATED  FLIGHT/ 
FIRE  CONTROL 
—  INTEGRATED  FLIGHT/ 
PROPULSION  CONTROL 

-  TRAJECTORY  CONTROL 

•  MULTIFUNCTIONAL  USE  OF 
SENSORS 

•  EXPLOIT  DIGITAL 
TECHNOLOGY 


Figure  1  Highly  Integreted  Syeteoe 


23-2 


•  Improved  pilot  and  C-*I  interface*  Such  improvements  provide  a  single,  coherent  interface 
for  the  pilot  as  he  manages  his  sophisticated  aircraft,  either  autonomously  or  in  cooperation 
with  other  vehicles. 

•  Improved  mission  performance  and  survivability.  Seeking  such  improvements  has  spurred  the 
development  of  functional  integration  concepts,  such  as  those  listed.  Coupling  these  previ¬ 
ously  autonomous  systems  often  increases  data  transfer  requirements  and  total  processing  re¬ 
quirements.  It  also  may  elevate  the  fault  tolerance  requirements  of  avionics  functions  which 
were  previously  not  flight  critical. 

•  Improved  reliability  and  affordability.  These  improvements  can  be  realized  by,  for  example, 
multi-functional  use  of  sensors  and  by  exploiting  digital  technology.  Here  the  self-test 
capability  of  digital  system  scan  be  used  to  provide  redundancy. 

Impact  on  Computer  System  Configurations 

With  recent  advances  in  computer  architecture  and  data-bus  technology,  the  capability  now  exists 
to  develop  computing  system  configurations  which  satisfy  the  performance  and  reliability  requirements 
of  functional  integration  while  optimizing  affordability.  Such  configurations  benefit,  for  example,  by 
the  cost  advantages  of  multi-functional  use  of  sensors.  While  considerable  work  has  been  done  on  the 
development  of  fault-tolerant  configurations  for  avionics  and  flight  control  systems  separately,  the 
design  of  appropriate  configurations  for  highly  integrated  systems  is  an  immature  technological  area. 
Other  authors  [1]  have  postulated  a  trend  towards  hierarchical  architectures,  which  attempt  to  derive 
the  benefits  of  both  centralized  and  distributed  processing. 

Hierarchical,  distributed,  fault-tolerant  architectures  present  system  designers  with  a  number  of 
unique  design  challenges,  such  as  hardware/ software  partitioning,  mode/ task/data  synchronization,  and 
redundancy  management.  Design  trade-offs  associated  with  meeting  these  challenges  can  have  far- 
reaching  impacts  on  the  performance  and  reliability,  and  ultimately  the  affordability,  of  the  developed 
system.  Clearly,  automated  tools  need  to  be  developed  and  applied  to  the  quantitative  analysis  of  com¬ 
puting  system  architectures  in  their  earliest  possible  development  stages. 

This  paper  presents  two  techniques  for  early  quantitative  analysis  of  alternative  computing  system 
architectures  for  highly  integrated  systems.  These  techniques  are  being  developed  by  Systems  Control 
in  its  on-going  work  in  fault-tolerant  digital  flight  control,  integrated  guidance  and  control,  and  the 
digital  control  of  jet  engines.  Example  applications  of  the  techniques  are  also  presented,  and  an 
assessment  is  offered  of  their  utility  in  reducing  the  overall  development  costs  of  complex  systems. 


NEED  FOR  EARLY  AND  SUSTAINED  SYSTEM  VALIDATION 

Previous  digital  systems  development  programs  have  been  marred  by  many  problems  which  tend  to  es¬ 
calate  development  costs.  Most  of  these  problems  can  be  traced  to: 

1)  inadequate  initial  allocation  for  duty-cycle  and  memory  margins  in  system  nodes  and  links; 

2)  inadequate,  inaccurate,  or  inconsistent  documentation  of  requirements  and  design  specifica¬ 
tions; 

3)  belated  discovery  of  design  errors, 

or  some  combination  of  these.  Inadequate  margins  force  the  system  implementers  to  compromise  many 
desirable  features  of  the  design;  for  example,  if  duty-cycle  timing  is  a  problem,  an  otherwise 
straightforward  and  easily  analyzed  design  may  be  obscured  by  reducing  the  iteration  rate  of  selected 
functions  or  resorting  to  coding  "tricks".  Often  this  problem  is  compounded  because  its  extent  is  dis¬ 
covered  late  in  the  development  process,  causing  extensive  redesign  to  implement  the  shortcuts.  Inade¬ 
quate  documentation  can  lead  to  confused  communications  between  analysts,  designers,  implementers,  and 
testers.  In  several  development  programs,  such  confusion  has  been  responsible  for  more  than  half  of 
the  total  system  errors  found  [2].  Belated  discovery  of  design  errors  necessitates  iterations  over 
prior  activities,  thereby  increasing  development  costs  and  "slipping"  development  schedules. 

Figure  2  illustrates  the  relative  cost  of  correcting  errors  during  various  development  phases,  as 
found  in  a  number  of  large-scale  software  development  programs  [2]. 

Front-End  Emphasis 

The  nature  of  these  historical  system  development  problems  indicates  that  high  pay-off  can  be 
achieved  by  placing  much  more  emphasis  on  the  early  stages  of  system  development.  For  illustration,  an 

idealized  structure  of  the  modern  system  development  process  [3)  is  shown  in  Figure  3.  In  the  struc¬ 
tured  approach,  the  system  development  is  divided  into  some  number  of  distinct  stages  (in  this  case, 

eight  stages),  each  having  identifiable  outputs  and  each  undergoing  a  specific  verification  or  valida¬ 

tion  step.  Phased  development  aa  illustrated  in  Figure  3  is  reflected  in  recent  United  States  Depart¬ 
ment  of  Defense  Directives  for  system  acquisition  (DOD  Directive  5000.1,  5000.2),  related  military 
standards  (MIL-STD-483 ,  MIL-STD-490) ,  and  more  recently  in  Federal  Aviation  Administration  and  EUROCAE 
recommendations  for  the  certification  of  airborne  digital  systems. 

Considerable  work  has  been  done  in  the  development  of  automated  tools  and  techniques  for  the  realm 
of  "software  engineering",  which  covers  roughly  Stages  3  through  5  of  Figure  3.  Given  a  complete  and 
coherent  system  design  specif icat ion  (Stage  2),  the  software  design  can  be  accomplished  reliably  using 
disciplined  documentat ion  control  and  such  proven  techniques  as  design  walk-throughs.  Often  a  "program 
design  language"  is  used  to  improve  communication  between  engineers  and  programmers,  and  to  provide  a 
basis  for  semi-automated  verification  of  design  constructs.  Once  the  coding  process  (Stage  4)  has 
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PHASE  IN  WHICH  ERROR  IS  DETECTED 


Figure  2  It  Pays  to  Catch  Software  Errors  Early 

begun  and  code  is  available,  then  numerous  automated  tools  (logic  analyzers,  assertion  checkers,  flow 
charting  programs,  etc.)  can  be  used  for  verif ication.  Stage  5  and  subsequent  stages  often  use  for 
validation  a  "hot  bench"  simulation  facility,  which  may  contain  increasing  amounts  of  the  actual  hard¬ 
ware  and  software. 

Approaches  to  Early  Validation 

Few  automated  or  semi-automated  techniques,  however,  have  been  developed  to  address  the  verifica¬ 
tion  of  the  very  early  development  stages,  namely  system  requirements  and  system  design  in  Figure  3. 
Instead,  modern  practice  relies  on  formal  and  informal  reviews,  and  analytical  studies  and  trade-off 
analyses  of  various  aspects  of  the  system  design.  Recognizing  the  high  potential  pay-off  of  the  early 
detection  of  requirements  deficiencies  or  system-level  design  errors,  procuring  agencies  have  occasion¬ 
ally  resorted  to  multiple  awards  of  preliminary  design  contracts  to  allow  selection  of  the  most  viable 
candidate.  Often  this  does  not  accomplish  the  goal  of  achieving  a  more  complete  preliminary  design; 
rather,  the  competition  may  result  in  several  preliminary  designs,  none  of  which  is  sufficiently  mature. 
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Figure  3  Structured  Development  Process 
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A  preferable  approach  is  to  increase  the  scope  of  the  preliminary  design  activity,  possibly  inclu¬ 
ding  the  services  of  an  independent  assessment  contractor  to  assist  in  proposing  and  evaluating  trade¬ 
off  analyses.  The  independent  assessment  contractor  may  be  the  same  organization  which  is  often 
employed  in  later  development  stages  to  perform  so-called  independent  verification  and  validation 
(IV&V)  of  software.  The  distinction  of  this  approach  is  that  the  independent  assessment  contractor  is 
brought  on  early  in  the  development  process,  before  the  system  design  or  software  design  is  firm,  and 
his  services  are  sustained  thoughout  the  development  process.  This  sustained  support  has  the  advantage 
of  retaining  knowledge  of  the  system  design  in  the  independent  assessment  contractor  to  aid  in  transi¬ 
tioning  the  system  from  development  to  deployment.  Systems  Control  has  performed  in  this  independent 
assessment  role  in  a  number  of  developments,  notably  the  on-going  Advanced  Fighter  Technology  Integra¬ 
tor  (AFTI)  F-16  development  of  a  digital  flight  control  system  and  integrated  fire/flight  control  con¬ 
cept.  The  value  of  such  sustained  validation  support  has  been  noted  in  other  development  programs,  for 
example,  the  B-l  Navigation  System  development  [4j. 


QUANTITATIVE  TOOLS  FOR  EARLY  VALIDATION 

The  key  to  successful  performance  of  sustained  system  validation  is  the  development  and  mainten¬ 
ance  of  a  set  of  tools  and  techniques  for  quantitative  system  evaluation.  As  mentioned  above,  modern 
software  engineering  provides  many  options  for  automated  or  semi-automated  system  validation  once  soft¬ 
ware  code  has  begun  to  appear. 

What  is  needed  are  quantitative  tools  which  can  be  applied  to  early  requirements  analysis  and 
design  assessments.  In  its  prior  work,  Systems  Control  has  developed  a  number  of  such  tools,  ranging 
from  performance  analysis  simulations  to  detailed  statement-level  emulations.  Two  of  these  techniques 
which  are  particularly  applicable  to  early  validation  are  presented  in  the  remainder  of  this  paper. 
These  techniques  are:  1)  Generalized  Reliability  and  Maintainability  Program  (CRAMP)  and  2)  Functional 
Emulation. 

After  a  brief  description  of  the  two  techniques,  it  will  be  shown  how  they  can  be  used  jointly  by 
an  independent  assessment  team  to  provide  early  design  validation. 


GENERALIZED  RELIABILITY  AND  MAINTAINABILITY  ANALYSIS 

The  Generalized  Reliability  and  Maintainability  Program  (GRAMP)  is  a  general  analysis  tool  origi¬ 
nally  developed  by  Systems  Control  for  the  design  of  fault  tolerant  or  other  more  general  systems.  As 
discussed  below,  GRAMP  can  be  an  extremely  useful  tool  for  performing  early  and  sustained  validation  of 
distributed,  redundant  systems  with  respect  to  reliability,  maintainability ,  cost  and  weight  require¬ 
ments. 

GRAMP  is  based  on  the  theory  of  coherent  system  repair  models  (CSRM)  [5l,  which  was  modified  to 
account  for  problems  intrinsic  to  fault  tolerant  systems  design  such  as  detection/  recovery  strategies 
and  component  and  analytical  redundancies.  Figure  4  presents  an  overview  of  the  program  structure. 
The  system  to  be  modeled  is  first  broken  down  into  components  which  are  replaceable  units  from  a  design 
standpoint  and  whose  failures  are  approximately  independent,  i.e.,  failure  in  one  component  will  not 
induce  failure  in  another.  GRAMP  takes  component  costs,  failure  rates,  and  faul t-tolerance  coverages 
in  addition  to  the  user-specified  system  design  and  maintenance  policy,  and  evaluates  such  quantities 
as  expected  system  operating  and  support  costs  per  unit  time,  reliability,  Mean  Time  Between  Failures 
(MTBF),  and  Mean  Time  Between  Repairs  (MTBR).  Sensitivities  of  these  output  values  to  various  compon¬ 
ent  input  parameters  can  be  computed. 


GRAMP 

•  SYSTEM  BOOKKEEPING 

•  MARKOV  DECISION  MODELS 
-  COST  EVALUATION  MODEL 

—  RELIABILITY/FEASIBILITY  MODEL 


Figure  4  Overview:  Generalized  Reliability  and  Maintainability  Program 
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The  CSRM  formulation  ia  attractive  in  that,  although  previously  having  never  been  applied  to  fault 
tolerant  syatea  design,  it  supplies  the  framework  for  solving  such  problems.  It  has  the  capability  to 
handle  repairable  systems  including  limited  opportunistic  maintenance,  analytical  redundancy  and  mul¬ 
tiple  objectives  within  a  single  framework.  A  dual  Harkov  model  approach  is  used  to  perform  the  compu¬ 
tations:  the  Cost  Evaluator  Model  (CEM)  is  a  static  repairable  system  model  which  evaluates  cost, 
MTBF,  MTBR,  and  other  steady  state  quantities.  Output  from  the  CEH  feeds  into  the  dynamic  closed- 
system  Reliability/Feasibility  Model  (RFM)  for  evaluation  of  reliability  over  specified  time  intervals 
or  mission  lengths. 

Advantages  of  CRAMP 

One  of  the  principal  advantages  of  the  GRAMP  approach  to  system  evaluation  or  validation  is  its 
efficiency.  In  using  it,  one  makes  more  restrictive  yet  realistic  assumptions  (e.g.,  constant  failure 
rates,  stationary  maintenance  policies)  on  the  system,  thus  allowing  sustained  validation  at  low  cost 
to  the  user,  i.e.,  numerous  test  runs  varying  system  design  configurations  and  input  data.  Monte  Carlo 
simulations,  although  applicable  and  containing  more  "true  to  life"  assumptions,  are  often  undesirable 
because  of  high  costs  per  run.  The  detailed  system  input  data  required  to  run  the  simulation  is  not 
likely  to  be  available,  especially  at  early  stages  of  the  system  design  process. 

Along  with  its  efficiency  relative  to  conventional  Monte  Carlo  methods,  GRAMP  has  several  unique 
features  which  make  it  capable  of  addressing  highly  integrated  systems.  For  example,  GRAMP  is  designed 
to  handle  non-standard  aspects  of  multiple-computer  systems,  such  factors  as  analytical  redundancy, 
iaiperfect  cross-strapping,  and  fault-tolerance  coverage.  In  addition,  GRAMP  will  calculate  multiple 
objective  functions  and  the  sensitivities  of  these  objectives  to  input  data.  This  is  necessary  because 
reliability,  maintainability,  and  cost  are  so  inter-related  that  each  can  not  be  controlled  indepen¬ 
dently. 

CRAMP  Applications 

As  a  design  tool.  Systems  Control  has  used  GRAMP  for  design  of  a  full  authority  fault-tolerant 
engine  electronic  controller  (FAFTEEC).  Numerous  possible  designs  and  maintenance  strategies  were  tes¬ 
ted  with  the  objective  of  obtaining  five  or  six  "good"  designs  to  be  analyzed  in  detail  using  Monte 
Carlo  methods.  System  design  goals  included  the  simultaneous  minimization  of  weight  and  cost  and  maxi¬ 
mization  of  reliability  and  mean  time  between  repairs  (MTBR)  subject  to  minimum  reliability  and  MTBR 
"standards"  or  "goals".  The  "beat"  candidate  configurations  were  then  analyzed  in  detail  using  Monte 
Carlo  methods.  Results  of  the  study  are  being  compiled  and  will  be  available  in  [6], 

GRAMP  Example 

To  illustrate  some  of  these  ideas,  Figure  5  shows  a  very  simple  example  of  a  GRAMP  analysis. 
Here,  a  three-component  subsystem  is  analyzed,  with  and  without  component  redundancy  and  with  two  dif¬ 
ferent  maintenance  policies.  Maintenance  Policy  A  is  to  repair  whenever  a  component  failure  is  detec¬ 
ted.  Maintenance  Policy  B  is  to  repair  only  after  the  total  end-to-end  function  is  lost,  i.e.  system 
redundancy  is  exhausted. 

The  top  configuration  is  simplex,  the  middle  two  are  duplex  by  component,  and  the  third  uses 
analytical  redundancy.  The  analytical  redundancy  means  that,  in  this  example,  each  of  the  three  paral¬ 
lel  strings  of  components  shown  is  capable  of  performing  the  subsystem  function.  Such  analytical 
redundancy,  when  it  is  appropriate,  is  usually  implemented  by  means  of  software. 
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Figure  5  Example  GRAMP  Outputs 


Referring  to  the  figure  and  progressing  downward  from  the  top  configuration,  the  second  line 
offers  better  reliability  due  to  duplex  component  redundancy*  The  duplex  redundancy,  along  with  the 
maintenance  policy  of  not  repairing  until  the  total  function  is  lost,  yields  infrequent  repairs  and  a 
favorable  operating  and  support  cost.  Reliability  can  be  improved  further  in  the  third  configuration 
by  repairing  as  a  single  component  failure  is  found,  but  frequency  of  repair  goes  up,  as  does  the  oper¬ 
ating  cost .  The  bottom  configuration  exploits  analytical  redundancy  to  yield  about  the  same  reliabil¬ 
ity  as  the  third  conf igurat ion,  but  at  greatly  reduced  operating  cost. 

Limitations  of  GRAMP 


A  limitation  of  GRAMr ,  and  of  all  reliability/  maintainability  modeling  techniques,  is  that  their 
results  depend  on  the  quality  of  data  concerning  component  failure  rates  and  fault  detection/isolation 
coverage.  While  GRAMP  can  y^eld  valuable  "sensitivity"  information  using  inaccurate  input  parameters, 
it  is  much  preferable  to  update  continually  the  failure  rate  and  coverage  parameters  as  more  is  learned 
about  the  system  under  development. 

The  ability  to  consider  fault-detec t ion/ ieolat ion  coverage,  a  characteristic  of  GRAMP  which  quali¬ 
fies  it  for  analyzing  fault-tolerant  systems,  places  the  additional  burden  (over  less  powerful  techni¬ 
ques)  of  estimating  coverage  parameters.  Self-test  coverage  can  be  assessed  in  straight-forward  ways, 
for  example,  by  injecting  a  large  number  of  simulated  failures  into  a  gate-level  emulation  and  recor¬ 
ding  the  number  of  errors  found  by  the  self-test  algorithms.  It  is  more  difficult  to  assess  the  effec¬ 
tiveness  of  coverage  other  Chan  self-test,  for  instance  that  coverage  internal  to  the  system's  redun¬ 
dancy  management  software,  which  may  use  cross-channel  monitoring  or  analytical  redundancy  techniques. 
A  means  of  estimating  this  type  of  system-level  fault  coverage  is  provided  as  a  by-product  of  the 
second  early-validat ion  tool.  Functional  Emulation. 


FUNCTIONAL  EMULATION 

Functional  Emulation  refers  to  all-software  simulation  of  the  architecture  of  the  developing  sys¬ 
tem.  As  distinct  from  the  conventional  statement-level  emulation  of  one  machine  by  another,  functional 
emulation  simulates  selected  hardware  and  software  components  of  the  developing  system  at  a  higher 
level  of  detail.  The  level  of  detail  is  selected  to  yield  the  simplest  possible  implementation  while 
assuring  adequate  fidelity  for  the  analyses  to  be  performed. 

The  technique  entails  modeling  the  processing  nodes  and  communications  links  in  the  system,  both 
hardware  and  software  components.  Within  the  nodes  and  links,  hardware  components  are  identified  to 
the  level  of  detail  commensurate  with  component  failures  the  user  wants  to  inject.  Software  components 
of  the  flight  systems  are  modeled  with  varying  fidelity,  with  the  most  attention  given  to  those  soft¬ 
ware  tasks  which  interact  intimately  with  the  hardware,  for  example,  the  executive,  link  interfaces, 
and  redundancy  management  algorithms.  Applications  tasks  such  as  control  laws  need  be  modeled  only  to 
analyze  the  interactions  between  basic  closed-loop  vehicle  dynamics  and  the  system  architecture  trom  a 
timing  point  of  view.  Questions  which  can  be  addressed  by  this  functional  emulation  are,  for  example: 

•  What  is  the  minimum  acceptable  time  to  detect  and  isolate  various  types  of  failures?  Is  that 
time  requirement  met  by  the  design? 

•  Does  the  system's  method  for  failure  detection,  isolation,  and  recovery  induce  unacceptable 
transients  in  aircraft  response? 

•  How  do  such  phenomena  as  executive  interplay  and  link  delays  add  to  the  overall  computational 
delay  from  sensor  to  control  surface? 

•  Are  adequate  margins  for  processing  node  duty-cycle  and  link  transmissions  met  by  the  system 
design? 

Functional  Emulation  Example 

To  illustrate  the  application  of  this  technique,  Figure  6  shows  the  approximate  level  of  detail 
modeled  in  the  Systems  Control  emulation  of  a  triplex  digital  flight  control  architecture,  similar  to 
that  of  the  AFTI/F-16  aircraft  in  development.  The  system  has  approximately  fifteen  motion  sensors, 
most  triply  redundant. 

The  three  flight  computers,  which  for  illustration  operate  asynchronously,  contain  various  compon¬ 
ents  for  analog-to-digital  conversion,  processing,  transmitting  and  receiving  on  inter-computer  data 
links,  memory,  etc.  The  Functional  Emulator  will  allow  the  user  to  invoke  models  of  failures  of  any  of 
these  components  (for  example,  a  link  transmitter  can  be  failed  to  quiet,  or  memory  locations  can  be 
made  to  fail  to  update).  The  servo  amplifier  switching  logic,  under  software  control  by  the  flight 
computers,  attempts  to  remove  failed  actuator  servo  amplifiers  and  failed  computers  from  driving  the 
aerosurfaces.  The  servo  amplifiers  are  triply  redundant  with  a  fourth  spare.  Actuator  hydraulics  are 
only  dual  redundant,  with  a  mechanical  voting  scheme  for  tripping  from  a  hydraulics  channel  being 
driven  by  disagreeing  servo-amplif ier  signals.  Models  of  the  flight  software  functions  (executive, 
failure  management,  control  laws,  etc.)  are  integrated  with  the  hardware  models  into  the  all-software 
emulation.  A  linear  aircraft  model,  when  combined  with  the  control  law  model,  provides  the  character¬ 
istic  aircraft  response  for  dynamic  studies. 


This  example  is  already  complex,  but  it  can  be  made  more  so  when  one  considers  that,  for  inte¬ 
grated  fire/flight  control,  additional  computers  for  target  tracking  and  director  fire  control  will  be 
issuing  commands  to  the  flight  control  complex  over  the  avionics  multiplex  data  bus.  In  this  case. 
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Figure  6  Example  Configuration  for  Triplex  Digital  Flight  Control  System 

executive  interplay  and  the  resulting  effective  computational  delay  are  additional  factors  to  be  consi¬ 
dered.  This  added  complexity  will  be  neglected  for  the  remainder  of  this  example. 

During  an  execution  of  the  Functional  Emulator,  the  interactive  computer  program  queries  the  user 
to  specify  initial  conditions  and  parameters  (e.g.,  skews  between  computers,  clock  errors,  sensor 
noise,  etc.)  and  failure  insertion  scenarios.  The  program  then  begins  a  simulated  run  and  flags  not¬ 
able  events  to  be  displayed  in  text  on  the  CRT  display  and/or  printer.  Hard  copy  plots  can  also  be 
generated,  at  user  option,  to  examine  dynamic  phenomena  such  as  the  transients  induced  while  failures 
are  being  detected,  isolated,  and  accommodated  by  the  flight  software  models.  Figure  7  shows  plots 
from  a  run  where  the  indicated  failures  were  injected  at  times  when  the  aircraft  is  responding  to  step 
commands  in  normal  acceleration.  The  transients  shown  in  the  first  step  response  in  Figure  7a  result 
from  the  failed  computer's  outputs  temporarily  being  passed  to  the  servos  until  a  software  threshold  is 
reached,  at  this  time  the  other  computers  remove  it  from  controlling  the  servos.  Such  thresholds  are 
necessary  lo  allow  for  normal  discrepancies  between  computers  due  to  asyncronisra,  or  to  accommodate 
temporary  low-level  noise.  The  transient  observable  in  the  second  step  response  in  Figure  7a  is  due  to 
failure  of  a  servo  amplifier  in  such  a  way  as  to  cause  the  hydraulic  system  to  switch  between  chan¬ 
nels.  Figure  7b  shows  corresponding  plots  of  the  horizontal  tail  (elevator)  response  of  each  of  the 
three  flight  control  computers;  the  asynchronism  between  computers  is  readily  apparent. 

Utility  of  Emulation 

Note  that  developing  a  Functional  Emulator  as  described  above  requires  the  development  of  models 
of  the  flight  software  to  some  degree.  This  can  be  used  to  advantage  in  that  the  emulator  models  con¬ 
stitute  a  validated  specification  for  detailed  flight  software  development.  The  models  are  coded  in  a 
high-level  language  which,  in  effect,  serves  as  a  program  design  language  (PDL)  for  flight  software 
programmers  to  use  as  a  guide. 

The  further  utility  of  the  functional  emulation  technique  in  the  system  development  process  is 

summarized  in  the  following  points: 

1)  Early  Design  Validation.  The  software  algorithms  for  executive  and  redundancy  management 

functions,  which  interact  intimately  with  the  hardware,  are  integrated  functionally  at  an 
early  stage.  This  identifies  basic  design  errors,  omissions,  and  inconsistencies,  and  it 
forces  design  ambiguities  to  be  resolved  before  progressing  to  the  later  implementation  stages, 

2)  Architecture  Analysis.  Emulation  provides  a  quantitative  tool  for  evaluating  trade-offs  and 
discovering  pathological  failure  sequences  and  timing  interactions. 

3)  Assuring  Adequate  Margins.  Given  estimates  of  the  processing  time  requirements  of  each  soft¬ 
ware  task  and  the  block  size  and  transmission  rates  of  the  links,  the  emulator  can  keep  track 

of  the  resource  utilization  of  all  the  r  *^es  and  links  in  the  system  in  order  to  assess 
reserve  capacity  (margin).  This  job  is  often  difficult  to  do  manually  because  many  software 
tasks  are  performed  on  demand  when  a  particular  event  happens  (e.g.,  a  failure  is  detected). 

4)  Design  Change  Evaluation.  The  emulation  technique  provides  a  means  for  quick  evaluation  of 
proposed  design  changes,  which  may  occur  at  any  point  in  the  design  process. 
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5)  Test  Direction.  Admittedly,  the  emulator  cannot  replace  laboratory  testing  as  a  final  vali¬ 
dation  of  the  design.  However,  it  can  serve  to  direct  the  testing  activity  towards  potential 
high  pay-off  areas  and  reduce  the  scope  of  testing  in  those  areas  where  the  emulator  results 
are  of  high  fidelity. 


RELATIONSHIP  OF  GRAMP  AND  FUNCTIONAL  EMULATION 

The  two  tools  represented  by  GRAMP  and  Functional  Emulation  can  work  together  to  provide  a  power¬ 
ful,  quantitative  capability  for  early  design  assessment.  The  relationship  of  the  two  techniques  as 
tools  used  by  an  independent  assessment  team  is  illustrated  in  Figure  8. 

As  shown,  GRAMP  is  used  to  verify  reliability  predictions  and  life-cycle  cost  projections.  It 
also  yields  sensitivity  results,  which  can  identify  weak  links  in  the  architecture. 

Emulation  is  used  to  yield  information  about  how  the  system  architecture  will  work  in  a  dynamic 
environment.  It  estimates  whether  the  architecture  will  meet  requirements  relating  to  f ault-tolerance 
coverage,  hardware/ software  interaction,  and  processing  reserve. 

Using  these  quantitative  tools,  the  independent  assessment  team  is  able  to  provide  a  specific  and 
authoritative  analysis  of  the  system  architecture. 

CONCLUSIONS  AND  RECOMMENDATIONS 

Experience  in  the  development  of  highly  integrated  guidance  and  control  systems  has  shown  the  need 
for  early  and  sustained  validation  of  the  developing  system.  The  services  of  an  independent  contractor 
for  design  assessment  and  software  validation  over  the  full  development  process  is  seen  to  be  prefer¬ 
able  over  intensive  but  belated  independent  software  verification  and  validation.  The  sustained 
approach  would  also  seem  to  be  more  cost  effective  than  competitive  procurements  for  preliminary 
design,  followed  by  conventional  development  practices  for  the  winning  competitor. 

Quantitative  evaluation  tools,  while  plentiful  for  the  later  software  development  and  testing 
phases,  are  lacking  for  the  early  system-level  development  phases  where  pay-off  potential  is  great. 
The  tools  discussed  in  this  paper,  Generalized  Reliability  and  Maintainabi l ity  Program  (GRAMP)  and 
Functional  Emulation,  focus  on  early  validation  and  have  proven  to  be  valuable  for  design  assessment 
through  all  stages  of  development. 


Figure  8  Relationship  of  Early  Design  Validation  Tools 
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